RHEL/CentOS: Update SELinux Contexts without Rebooting by Using setfiles Command #788

Poorna-Gottimukkula1 · 2025-07-22T10:04:11Z

This PR update setup script to avoid a reboot when updating SELinux contexts. The change replaces the touch /.autorelabel command with setfiles -F /etc/selinux/targeted/contexts/files/file_contexts /, which applies the required SELinux file context updates without needing a system reboot. This reduces setup time and eliminates the need for an additional system restart after completing the setup

…d of touch /.autorelabel

sudeeshjohn · 2025-07-23T02:04:04Z

@Poorna-Gottimukkula1 this works irrespective of the environment’s selinux settings(disabled , permissive and enforcing) ?

Poorna-Gottimukkula1 · 2025-07-23T07:38:59Z

@Poorna-Gottimukkula1 this works irrespective of the environment’s selinux settings(disabled , permissive and enforcing) ?

Yes, tested RHEL-9.6 with various selinux settings(disabled , permissive and enforcing).

[root@test1 ~]# getenforce
Enforcing
[root@test1 ~]# ls -Z /
        system_u:object_r:mnt_t:s0 afs           system_u:object_r:lib_t:s0 lib64          system_u:object_r:bin_t:s0 sbin
        system_u:object_r:bin_t:s0 bin           system_u:object_r:mnt_t:s0 media  system_u:object_r:etc_runtime_t:s0 setup.sh
       system_u:object_r:boot_t:s0 boot          system_u:object_r:mnt_t:s0 mnt            system_u:object_r:var_t:s0 srv
     system_u:object_r:device_t:s0 dev           system_u:object_r:usr_t:s0 opt          system_u:object_r:sysfs_t:s0 sys
        system_u:object_r:etc_t:s0 etc          system_u:object_r:proc_t:s0 proc           system_u:object_r:tmp_t:s0 tmp
  system_u:object_r:home_root_t:s0 home   system_u:object_r:admin_home_t:s0 root           system_u:object_r:usr_t:s0 usr
        system_u:object_r:lib_t:s0 lib       system_u:object_r:var_run_t:s0 run            system_u:object_r:var_t:s0 var
[root@test1 ~]# last -x | grep reboot
reboot   system boot  5.14.0-598.el9.p Tue Jul 22 04:58   still running

[root@test-permissive-set ~]# getenforce
Permissive
[root@test-permissive-set ~]# ls -Z /
        system_u:object_r:mnt_t:s0 afs           system_u:object_r:lib_t:s0 lib64          system_u:object_r:bin_t:s0 sbin
        system_u:object_r:bin_t:s0 bin           system_u:object_r:mnt_t:s0 media  system_u:object_r:etc_runtime_t:s0 setup.sh
       system_u:object_r:boot_t:s0 boot          system_u:object_r:mnt_t:s0 mnt            system_u:object_r:var_t:s0 srv
     system_u:object_r:device_t:s0 dev           system_u:object_r:usr_t:s0 opt          system_u:object_r:sysfs_t:s0 sys
        system_u:object_r:etc_t:s0 etc          system_u:object_r:proc_t:s0 proc           system_u:object_r:tmp_t:s0 tmp
  system_u:object_r:home_root_t:s0 home   system_u:object_r:admin_home_t:s0 root           system_u:object_r:usr_t:s0 usr
        system_u:object_r:lib_t:s0 lib       system_u:object_r:var_run_t:s0 run            system_u:object_r:var_t:s0 var
[root@test-permissive-set ~]# last -x | grep reboot
reboot   system boot  5.14.0-570.28.1. Wed Jul 23 03:28   still running

[root@test-disabled-set ~]# getenforce
Disabled
[root@test-disabled-set ~]# ls -Z /
        system_u:object_r:mnt_t:s0 afs           system_u:object_r:lib_t:s0 lib64          system_u:object_r:bin_t:s0 sbin
        system_u:object_r:bin_t:s0 bin           system_u:object_r:mnt_t:s0 media  system_u:object_r:etc_runtime_t:s0 setup.sh
       system_u:object_r:boot_t:s0 boot          system_u:object_r:mnt_t:s0 mnt            system_u:object_r:var_t:s0 srv
                                 ? dev           system_u:object_r:usr_t:s0 opt                                     ? sys
        system_u:object_r:etc_t:s0 etc                                    ? proc           system_u:object_r:tmp_t:s0 tmp
  system_u:object_r:home_root_t:s0 home   system_u:object_r:admin_home_t:s0 root           system_u:object_r:usr_t:s0 usr
        system_u:object_r:lib_t:s0 lib                                    ? run            system_u:object_r:var_t:s0 var
[root@test-disabled-set ~]# last -x | grep reboot
reboot   system boot  5.14.0-570.28.1. Wed Jul 23 03:35   still running

I don't see any issue, regardless of the environment's SELinux settings (image build VM).

mkumatag · 2025-07-23T08:38:06Z

Approximately how much time we can save with this change?

Poorna-Gottimukkula1 · 2025-07-23T08:43:43Z

Approximately how much time we can save with this change?

Around 1.5 - 2 m

I just triggered the OCP deploy using the newly created image.

module.bastion.null_resource.bastion_init[0]: Creation complete after 2m28s [id=6955633628581543805]

Previous three jobs took around 4m42s

1. module.bastion.null_resource.bastion_init[0]: Creation complete after 4m42s [id=1235290572954074843]
2. module.bastion.null_resource.bastion_init[0]: Creation complete after 4m42s [id=5945047114692171536]
3. module.bastion.null_resource.bastion_init[0]: Creation complete after 4m43s [id=7535059377970327901]

mkumatag · 2025-07-23T09:39:39Z

This is just wow!

Around 1.5 - 2 m

mkumatag · 2025-07-31T03:59:44Z

@sudeeshjohn can you review and merge this PR if all okay?

sudeeshjohn · 2025-08-04T13:27:58Z

@Poorna-Gottimukkula1 did you test this for rhel10 ?

Poorna-Gottimukkula1 · 2025-08-07T13:26:01Z

@Poorna-Gottimukkula1 did you test this for rhel10 ?

I haven’t tested it on RHEL-10 yet. the image build works fine, I’ll test the image and update here once it’s done.

Poorna-Gottimukkula1 · 2025-08-08T05:33:20Z

Tested this on RHEL-10

[root@rhel-10-setfiles ~]# getenforce
Enforcing
[root@rhel-10-setfiles ~]#  last -x | grep reboot
reboot   system boot  6.12.0-55.9.1.el Thu Aug  7 14:19   still running
[root@rhel-10-setfiles ~]# ls -Z /
        system_u:object_r:mnt_t:s0 afs           system_u:object_r:lib_t:s0 lib64          system_u:object_r:bin_t:s0 sbin
        system_u:object_r:bin_t:s0 bin           system_u:object_r:mnt_t:s0 media  system_u:object_r:etc_runtime_t:s0 setup.sh
       system_u:object_r:boot_t:s0 boot          system_u:object_r:mnt_t:s0 mnt            system_u:object_r:var_t:s0 srv
     system_u:object_r:device_t:s0 dev           system_u:object_r:usr_t:s0 opt          system_u:object_r:sysfs_t:s0 sys
        system_u:object_r:etc_t:s0 etc          system_u:object_r:proc_t:s0 proc           system_u:object_r:tmp_t:s0 tmp
  system_u:object_r:home_root_t:s0 home   system_u:object_r:admin_home_t:s0 root           system_u:object_r:usr_t:s0 usr
        system_u:object_r:lib_t:s0 lib       system_u:object_r:var_run_t:s0 run            system_u:object_r:var_t:s0 var
[root@rhel-10-setfiles ~]# cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="10.0 (Coughlan)"
ID="rhel"
ID_LIKE="centos fedora"
VERSION_ID="10.0"
PLATFORM_ID="platform:el10"
PRETTY_NAME="Red Hat Enterprise Linux 10.0 (Coughlan)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:10::baseos"
HOME_URL="https://www.redhat.com/"
VENDOR_NAME="Red Hat"
VENDOR_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/10"
BUG_REPORT_URL="https://issues.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 10"
REDHAT_BUGZILLA_PRODUCT_VERSION=10.0
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="10.0"

mkumatag

/lgtm

/hold
for @sudeeshjohn to give a final ack and merge

sudeeshjohn

/lgtm

ppc64le-cloud-bot · 2025-08-13T03:27:07Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mkumatag, Poorna-Gottimukkula1, sudeeshjohn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [mkumatag]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Poorna-Gottimukkula1 · 2025-08-13T06:32:25Z

Tested this on 8.10 as well.

[root@test1-810 ~]# getenforce
Enforcing
[root@test1-810 ~]#  last -x | grep reboot
reboot   system boot  4.18.0-553.69.1. Wed Aug 13 02:31   still running
[root@test1-810 ~]#  ls -Z /
        system_u:object_r:bin_t:s0 bin            system_u:object_r:mnt_t:s0 media  system_u:object_r:etc_runtime_t:s0 setup.sh
       system_u:object_r:boot_t:s0 boot           system_u:object_r:mnt_t:s0 mnt            system_u:object_r:var_t:s0 srv
     system_u:object_r:device_t:s0 dev            system_u:object_r:usr_t:s0 opt          system_u:object_r:sysfs_t:s0 sys
        system_u:object_r:etc_t:s0 etc           system_u:object_r:proc_t:s0 proc           system_u:object_r:tmp_t:s0 tmp
  system_u:object_r:home_root_t:s0 home    system_u:object_r:admin_home_t:s0 root           system_u:object_r:usr_t:s0 usr
        system_u:object_r:lib_t:s0 lib        system_u:object_r:var_run_t:s0 run            system_u:object_r:var_t:s0 var
        system_u:object_r:lib_t:s0 lib64          system_u:object_r:bin_t:s0 sbin
[root@test1-810 ~]#  cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="8.10 (Ootpa)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux 8.10 (Ootpa)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:8::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8"
BUG_REPORT_URL="https://issues.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_BUGZILLA_PRODUCT_VERSION=8.10
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="8.10"
[root@test1-810 ~]#

sudeeshjohn · 2025-08-13T06:35:03Z

/unhold

Updated the script to use setfiles for SELinux context changes instea…

44cef3e

…d of touch /.autorelabel

ppc64le-cloud-bot requested review from mkumatag and sudeeshjohn July 22, 2025 10:04

ppc64le-cloud-bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jul 22, 2025

mkumatag approved these changes Aug 11, 2025

View reviewed changes

ppc64le-cloud-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 11, 2025

ppc64le-cloud-bot assigned mkumatag Aug 11, 2025

ppc64le-cloud-bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Aug 11, 2025

sudeeshjohn approved these changes Aug 13, 2025

View reviewed changes

ppc64le-cloud-bot assigned sudeeshjohn Aug 13, 2025

ppc64le-cloud-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 13, 2025

ppc64le-cloud-bot merged commit 40d4039 into ppc64le-cloud:main Aug 13, 2025
5 checks passed

mkumatag mentioned this pull request Sep 3, 2025

qcow2ova image command fails with latest v0.1.23 #812

Closed

Poorna-Gottimukkula1 mentioned this pull request Sep 3, 2025

Revert PR-788 RHEL/CentOS: Update SELinux Contexts without Rebooting by Using setfiles Command #813

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

RHEL/CentOS: Update SELinux Contexts without Rebooting by Using setfiles Command #788

RHEL/CentOS: Update SELinux Contexts without Rebooting by Using setfiles Command #788

Uh oh!

Poorna-Gottimukkula1 commented Jul 22, 2025 •

edited

Loading

Uh oh!

sudeeshjohn commented Jul 23, 2025

Uh oh!

Poorna-Gottimukkula1 commented Jul 23, 2025 •

edited

Loading

Uh oh!

mkumatag commented Jul 23, 2025

Uh oh!

Poorna-Gottimukkula1 commented Jul 23, 2025

Uh oh!

mkumatag commented Jul 23, 2025 •

edited

Loading

Uh oh!

mkumatag commented Jul 31, 2025

Uh oh!

sudeeshjohn commented Aug 4, 2025

Uh oh!

Poorna-Gottimukkula1 commented Aug 7, 2025

Uh oh!

Poorna-Gottimukkula1 commented Aug 8, 2025

Uh oh!

mkumatag left a comment

Uh oh!

sudeeshjohn left a comment

Uh oh!

ppc64le-cloud-bot commented Aug 13, 2025

Uh oh!

Poorna-Gottimukkula1 commented Aug 13, 2025

Uh oh!

sudeeshjohn commented Aug 13, 2025

Uh oh!

Uh oh!

Uh oh!

RHEL/CentOS: Update SELinux Contexts without Rebooting by Using setfiles Command #788

RHEL/CentOS: Update SELinux Contexts without Rebooting by Using setfiles Command #788

Uh oh!

Conversation

Poorna-Gottimukkula1 commented Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sudeeshjohn commented Jul 23, 2025

Uh oh!

Poorna-Gottimukkula1 commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mkumatag commented Jul 23, 2025

Uh oh!

Poorna-Gottimukkula1 commented Jul 23, 2025

Uh oh!

mkumatag commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mkumatag commented Jul 31, 2025

Uh oh!

sudeeshjohn commented Aug 4, 2025

Uh oh!

Poorna-Gottimukkula1 commented Aug 7, 2025

Uh oh!

Poorna-Gottimukkula1 commented Aug 8, 2025

Uh oh!

mkumatag left a comment

Choose a reason for hiding this comment

Uh oh!

sudeeshjohn left a comment

Choose a reason for hiding this comment

Uh oh!

ppc64le-cloud-bot commented Aug 13, 2025

Uh oh!

Poorna-Gottimukkula1 commented Aug 13, 2025

Uh oh!

sudeeshjohn commented Aug 13, 2025

Uh oh!

Uh oh!

Uh oh!

Poorna-Gottimukkula1 commented Jul 22, 2025 •

edited

Loading

Poorna-Gottimukkula1 commented Jul 23, 2025 •

edited

Loading

mkumatag commented Jul 23, 2025 •

edited

Loading