[rpms/ignition] f43: patch: backport fix for SELinux relabelling failures when specifying a symlink for home_dir

[rpms/ignition] f43: patch: backport fix for SELinux relabelling failures when specifying a symlink for home_dir

[Rolv Apneseth]

A new commit has been pushed.

Repo   : rpms/ignition
Branch : f43
Commit : 734bd4bc4fc03cc22283439926aa24fa24a98feb
Author : Rolv Apneseth <rolv.apneseth@gmail.com>
Date   : 2026-09-14T17:26:32+01:00
Stats  : +76/-2 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/ignition/c/734bd4bc4fc03cc22283439926aa24fa24a98feb?branch=f43

Log:
patch: backport fix for SELinux relabelling failures when specifying a symlink for home_dir

---
diff --git a/0001-internal-exec-stages-files-resolve-intermediate-syml.patch b/0001-internal-exec-stages-files-resolve-intermediate-syml.patch
new file mode 100644
index 0000000..d08417e
--- /dev/null
+++ b/0001-internal-exec-stages-files-resolve-intermediate-syml.patch
@@ -0,0 +1,63 @@
+From 6dd62cb069f1d7d214a50bebc0677800328986be Mon Sep 17 00:00:00 2001
+From: Rolv Apneseth <rolv.apneseth@gmail.com>
+Date: Tue, 1 Sep 2026 14:53:44 +0100
+Subject: [PATCH] internal/exec/stages/files: resolve intermediate symlinks in
+ relabel paths
+
+Due to a recent libselinux (3.11) update in the next/testing streams of
+FCOS, Software Factory nodes started failing provisioning.
+
+They had a home_dir: /home/zuul-worker defined in their butane config
+and were failing with a relabelling issue. With the 3.11 update
+(including
+https://github.com/SELinuxProject/selinux/commit/67bc978bfaf9e4d00883fbaf1f83f5fb6a0018ce),
+lstat() was replaced with safe_open() using O_NOFOLLOW on intermediate
+path components. This ended up exposing a latent bug in Ignition since
+only the final component was being resolved via ResolveSymlink(), so
+/home/user (where /home -> var/home on ostree) is passed unresolved.
+setfiles no longer resolves for us, leading to the failures.
+
+Avoid this issue by using JoinPath() to resolve intermediate symlinks in
+directory paths before passing them to setfiles for SELinux relabelling.
+
+https://github.com/coreos/ignition/pull/2316
+---
+ docs/release-notes.md                |  1 +
+ internal/exec/stages/files/passwd.go | 17 +++++++++++++----
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/internal/exec/stages/files/passwd.go b/internal/exec/stages/files/passwd.go
+index 737e9cced..85f661945 100644
+--- a/internal/exec/stages/files/passwd.go
++++ b/internal/exec/stages/files/passwd.go
+@@ -80,17 +80,26 @@ func (s *stage) createPasswd(config types.Config) error {
+ 				return err
+ 			}
+ 
++			// Resolve intermediate symlinks in the homedir path.
++			// This is relevant on OSTree-based platforms, where
++			// /home is a symlink to var/home.
++			resolvedPath, err := s.JoinPath(homedir)
++			if err != nil {
++				return err
++			}
++			unprefixed := resolvedPath[len(s.DestDir):]
++
+ 			// Check if the homedir is actually a symlink, and make sure we
+ 			// relabel the target instead in that case. This is relevant on
+ 			// OSTree-based platforms, where /root is a link to /var/roothome.
+-			if resolved, err := s.ResolveSymlink(homedir); err != nil {
++			if target, err := s.ResolveSymlink(unprefixed); err != nil {
+ 				return err
+-			} else if resolved != "" {
++			} else if target != "" {
+ 				// note we don't relabel the symlink itself; we assume it's
+ 				// already properly labeled
+-				s.relabel(resolved)
++				s.relabel(target)
+ 			} else {
+-				s.relabel(homedir)
++				s.relabel(unprefixed)
+ 			}
+ 		}
+ 	}

diff --git a/ignition.spec b/ignition.spec
index a7ef237..ac430ca 100644
--- a/ignition.spec
+++ b/ignition.spec
@@ -22,7 +22,7 @@ Version:                2.27.0
 %global dracutlibdir %{_prefix}/lib/dracut
 
 Name:           ignition
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        First boot installer and configuration tool
 
 # Upstream license specification: Apache-2.0
@@ -32,6 +32,11 @@ Source0:        %{gosource}
 Source1:        https://github.com/fedora-iot/ignition-edge/archive/%{ignedgecommit}/ignition-edge-%{ignedgeshortcommit}.tar.gz
 Source2:        91-ignition-authorized-keys-file.conf
 
+# Backport fix for SELinux relabelling failures when specifying a symlink for home_dir
+# https://github.com/coreos/ignition/pull/2316
+# https://github.com/coreos/fedora-coreos-tracker/issues/2216
+Patch0:         0001-internal-exec-stages-files-resolve-intermediate-syml.patch
+
 BuildRequires: libblkid-devel
 BuildRequires: systemd-rpm-macros
 
@@ -225,7 +230,7 @@ Summary:  Enablement glue for bootupd's grub2 config
 License:  Apache-2.0
 
 # `ignition-grub` is a rename `ignition-ignition-grub` so let's obsolete `ignition-ignition-grub`
-Obsoletes: ignition-ignition-grub
+Obsoletes: ignition-ignition-grub < 2.21.0-2
 
 %description grub
 This package contains the grub2 config which is compatable with bootupd.
@@ -460,6 +465,12 @@ install -p -m 0755 ./ignition %{buildroot}/%{dracutlibdir}/modules.d/30ignition
 %endif
 
 %changelog
+* Mon Sep 14 2026 Rolv Apneseth <rapneset@redhat.com> - 2.27.0-3
+- Backport fix for SELinux relabelling failures when specifying a symlink for home_dir
+  https://github.com/coreos/ignition/pull/2316
+  https://github.com/coreos/fedora-coreos-tracker/issues/2216
+- Add version to ignition-ignition-grub Obsoletes to fix rpmbuild warning
+
 * Wed Sep 02 2026 Klara Necasova <knecasov@redhat.com> - 2.27.0-2
 - Update ignition-edge commit to include https://github.com/fedora-iot/ignition-edge/pull/12