veilor-org/veilor-os
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

ks: SELinux permissive at build (PCRE2 mismatch); enforcing+relabel at first boot

Browse source
This commit is contained in:
veilor 2026-04-30 09:43:33 +01:00
parent 238e461553
commit e965b148f5
2 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
kickstart/veilor-os.ks
View file

@ -15,7 +15,11 @@ timezone Europe/London --utc
# Note: no display mode (text/graphical/cmdline) — livemedia-creator forbids.
firstboot --disable
eula --agreed
selinux --enforcing
# Build-time SELinux disabled to avoid PCRE2 regex version mismatch between
# host libselinux and chroot's selinux-policy file_contexts.bin (pcre2 10.46
# vs 10.47). veilor-firstboot.service triggers `fixfiles -F onboot` and
# `setenforce 1` on first boot to re-enable enforcing mode.
selinux --permissive
services --enabled=sshd,fail2ban,usbguard,tuned,auditd,firewalld,chronyd,sddm,veilor-firstboot,veilor-modules-lock
# ── Network / hostname ──

9
overlay/usr/local/sbin/veilor-firstboot
View file

@ -40,7 +40,14 @@ touch "$STATE"
systemctl disable veilor-firstboot.service >/dev/null 2>&1 || true
echo
echo " Password set. Starting graphical session..."
echo " Password set."
echo " Re-enabling SELinux enforcing mode..."
# Re-enable SELinux (build-time disabled to bypass pcre2/regex mismatch).
# Set to enforcing for next boot, schedule full relabel.
sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config 2>/dev/null
touch /.autorelabel 2>/dev/null
echo " Starting graphical session..."
sleep 2
# Start SDDM (was held back by service ordering)