Re: Grub, EFI, and SELinux
On Fri, May 1, 2020 at 12:03 PM Jerry James <loganjerry(a)gmail.com> wrote:
On Fri, May 1, 2020 at 7:55 AM Christopher <ctubbsii(a)fedoraproject.org> wrote:
> Can anybody tell me why the grub package seems to want to label files
> on the EFI partition during updates?
> I had thought that, by definition, EFI partitions were basically FAT,
> which doesn't support the extended attributes for SELinux contexts...
>
> So, why does the Grub package insist on attempting to label the EFI
> partition, as in the following?
>
> Upgrading : grub2-common-1:2.04-15.fc32.noarch
> 2/127
> error: lsetfilecon: (/boot/efi/EFI/fedora,
> system_u:object_r:boot_t:s0) Operation not supported
>
> I noticed this first on F31 for the first time, awhile back, but I
> figured it was harmless and would be fixed eventually. However, since
> it has been happening for months on F31, and still is happening on F32
> now that I've upgraded, I'm wondering if there's a good reason why
> it's trying to do this.
See:
https://bugzilla.redhat.com/show_bug.cgi?id=1722766
https://github.com/rpm-software-management/rpm/pull/976
Those are bugs filed against RPM. Is the RPM package responsible for
executing lsetfilecon, or is it the grub2 package? If the grub2
package, it seems to me that they should know that EFI partitions will
never support lsetfilecon and they should never try. If it's RPM, then
it looks like it is suppressed upstream and the fix will be
incorporated eventually. I guess I don't know which component is
actually responsible for causing the execution of lsetfilecon.