With a tethered root (and on EL8 always), the initramfs writes the
overlay upper layer before the SELinux policy is loaded, so those files
are unlabeled_t. On a captured enforcing image sshd-keygen then cannot
search / and the node comes up without sshd.
Label exactly the upper layer paths with matchpathcon and chcon.
setfiles would recurse into the merged tree and restorecon is a no-op
before policy load. Built images have SELinux disabled and skip this.
Markus Hilger
dc909e6f0b