From 61e0524a56ec92a0cc7068042ddc1c07f68f7fca Mon Sep 17 00:00:00 2001
From: Jarrod Johnson <jjohnson2@lenovo.com>
Date: Thu, 23 Jul 2026 15:58:07 -0400
Subject: [PATCH] Some fixup of SELinux contexts for EL10 diskless boot

Unfortunately, the problem of urlmount's selinux context is left open.

urlmount starts before policy load, preventing transition.

However the policy blocks access urlmount needs when loaded.
---
 .../el10-diskless/profiles/default/scripts/imageboot.sh         | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh b/confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh
index 86ba145a..bc7e5f9c 100644
--- a/confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh
+++ b/confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh
@@ -4,6 +4,7 @@ if [[ "$confluent_whost" == *:* ]] && [[ "$confluent_whost" != "["* ]]; then
     confluent_whost="[$confluent_mgr]"
 fi
 mkdir -p /mnt/remoteimg /mnt/remote /mnt/overlay /sysroot
+set_selinux_context system_u:object_r:bin_t:s0 /opt/confluent/bin/urlmount
 if [ "untethered" = "$(getarg confluent_imagemethod)" -o "uncompressed" = "$(getarg confluent_imagemethod)" ]; then
     mount -t tmpfs untethered /mnt/remoteimg
     curl https://$confluent_whost/confluent-public/os/$confluent_profile/rootimg.sfs -o /mnt/remoteimg/rootimg.sfs
@@ -181,6 +182,7 @@ if [ $TETHERED -eq 1 ]; then
 else
     rm -rf /lib/modules/$(uname -r) /lib/modules/$(uname -r)-ramfs /lib/firmware-ramfs /usr/lib64/libcrypto.so* /usr/lib64/systemd/ /kernel/ /usr/bin/ /usr/sbin/ /usr/libexec/
 fi
+set_selinux_context system_u:object_r:root_t:s0 /sysroot
 if grep debugssh /proc/cmdline >& /dev/null; then
     exec /opt/confluent/bin/start_root
 else