Help to verify this SELinux related scripts on atomic systems (chcon, bin_t)

Unfortunately their change is a partial implementation on what is required.

Currently the file has no file context. When using chcon it is expecting there to be an existing file context. In this case you will need to provide the entire context.

chcon -u system_u -r object_r -t bin_t /usr/lib/rustdesk/rustdesk

Generally speaking I would recommend using semanage fcontext as well since chcon doesn’t actually update SELinux.

Realistically, I’m a bit confused on why this is being shipped as the mechanism to solve their SELinux issues. While it works it also means that restorecon would likely remove it.

For a get things working you can use our old workaround items. An example is here: bazzite/system_files/desktop/shared/usr/lib/systemd/system/incus-workaround.service at 15969013f8005fad062e6bb455fd9fe021dc6c2b · ublue-os/bazzite · GitHub

For more explanation on this workaround see: SELinux Workarounds for binaries with the wrong label

Note restorecon won’t work unless you use semanage fcontext first to properly create a file context.

1 Like