fix: various selinux issues

ucore/post-install-ucore-minimal.sh

@@ -23,6 +23,11 @@ ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/bin/docker-compose
 systemctl disable docker.socket
 systemctl disable zincati.service
 
+systemctl enable gssproxy-workaround.service
+systemctl enable libvirt-workaround.service
+systemctl enable swtpm-workaround.service
+
+
 systemctl enable ucore-paths-provision.service
 systemctl enable rpm-ostreed-automatic.timer
 

ucore/system_files/usr/lib/systemd/system/gssproxy-workaround.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Workaround to relabel gssproxy files and directories
+ConditionPathIsDirectory=/var/lib/gssproxy/
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=-/usr/sbin/restorecon -Rv /var/lib/gssproxy/
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

ucore/system_files/usr/lib/systemd/system/libvirt-workaround.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Workaround to relabel libvirt files and directories
+ConditionPathIsDirectory=/var/lib/libvirt/
+After=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=-/usr/sbin/restorecon -Rv /var/lib/libvirt/
+ExecStart=-/usr/sbin/restorecon -Rv /var/log/libvirt/
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

ucore/system_files/usr/lib/systemd/system/swtpm-workaround.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Workaround swtpm not having the correct label
+ConditionFileIsExecutable=/usr/bin/swtpm
+After=local-fs.target
+
+[Service]
+Type=oneshot
+# Copy if it doesn't exist
+ExecStartPre=/usr/bin/bash -c "[ -x /usr/local/bin/overrides/swtpm ] || /usr/bin/cp /usr/bin/swtpm /usr/local/bin/overrides/swtpm"
+# This is faster than using .mount unit. Also allows for the previous line/cleanup
+ExecStartPre=/usr/bin/mount --bind /usr/local/bin/overrides/swtpm /usr/bin/swtpm
+# Fix SELinux label
+ExecStart=/usr/sbin/restorecon /usr/bin/swtpm
+# Clean-up after ourselves
+ExecStop=/usr/bin/umount /usr/bin/swtpm
+ExecStop=/usr/bin/rm /usr/local/bin/overrides/swtpm
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

ucore/system_files/usr/lib/tmpfiles.d/gssproxy-workaround.conf

@@ -0,0 +1,3 @@
+d /var/lib/gssproxy 0755 root root -
+d /var/lib/gssproxy/clients 0755 root root -
+d /var/lib/gssproxy/rcache 0755 root root -

ucore/system_files/usr/lib/tmpfiles.d/libvirt-workaround.conf

@@ -0,0 +1 @@
+d /var/log/libvirt 0750 - - - -

ucore/system_files/usr/lib/tmpfiles.d/swtpm-workaround.conf

@@ -0,0 +1,2 @@
+C /usr/local/bin/overrides/swtpm - - - - /usr/bin/swtpm
+d /var/lib/swtpm-localca 0750 tss tss - -