Bug 2360183

Summary: restorecon no longer set right label from file_contexts.local
Product: [Fedora] Fedora Reporter: Paul Holzinger <pholzing>
Component: libselinuxAssignee: Petr Lautrbach <plautrba>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 42CC: dwalsh, lvrabec, mmalik, plautrba, vmojzis
Target Milestone: ---Keywords: Regression, Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: libselinux-3.8-2.fc42 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-06-06 01:44:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Paul Holzinger 2025-04-16 14:33:51 UTC
After the update to f42 restorecon doesn't seem to correctly label files when a local context is defined for them.

I face the problem with cloud-init as I try to relabel that to bin_t.

Reproducible: Always

Steps to Reproduce:
1. dnf in cloud-init
2. semanage fcontext --add --type bin_t /usr/bin/cloud-init
3. restorecon -v /usr/bin/cloud-init
4. ls -Z /usr/bin/cloud-init
Actual Results:
The cloud-init binary is still labelled cloud_init_exec_t


Expected Results:
The cloud-init binary should be labelled bin_t like it is on f41.

Additional Information:
# rpm -q policycoreutils
policycoreutils-3.8-1.fc42.aarch64

# semanage fcontext -l | grep cloud-init
/etc/NetworkManager/dispatcher\.d/cloud-init-azure-hook regular file       system_u:object_r:NetworkManager_dispatcher_cloud_script_t:s0 
/run/cloud-init(/.*)?                              all files          system_u:object_r:net_conf_t:s0 
/usr/bin/cloud-init                                all files          system_u:object_r:bin_t:s0 
/usr/bin/cloud-init                                regular file       system_u:object_r:cloud_init_exec_t:s0 
/usr/lib/systemd/system-generators/cloud-init.*    all files          system_u:object_r:cloud_init_exec_t:s0 
/usr/lib/systemd/system/cloud-init.*               regular file       system_u:object_r:cloud_init_unit_file_t:s0 
/var/log/cloud-init.*\.log.*                       regular file       system_u:object_r:cloud_log_t:s0

Comment 2 Fedora Update System 2025-05-29 14:47:17 UTC
FEDORA-2025-6a639a8d46 (libselinux-3.8-2.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-6a639a8d46

Comment 3 Fedora Update System 2025-05-29 16:05:01 UTC
FEDORA-2025-6a639a8d46 (libselinux-3.8-2.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 4 Paul Holzinger 2025-05-30 09:39:23 UTC
Note I reported this but against F42 so I would love for this to be fixed in F42 as well not just rawhide, thanks.

Comment 5 Fedora Update System 2025-06-03 07:25:28 UTC
FEDORA-2025-af1d4236ee (libselinux-3.8-2.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-af1d4236ee

Comment 6 Fedora Update System 2025-06-04 04:30:06 UTC
FEDORA-2025-af1d4236ee has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-af1d4236ee`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-af1d4236ee

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-06-06 01:44:11 UTC
FEDORA-2025-af1d4236ee (libselinux-3.8-2.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.