[whot]

Try to restore the context for SELinux. If we fail on running
'selinuxenabled', quietly ignore the error and continue. If we fail on the
actual restorecon call, we print a message but disable SELinux - chances are
high that if one restorecon fails, others will too and that's likely a system
setup issue.

Fixes #1967

[jpakkane]

I don't really grok SELinux, but is there a way to add a test for this?

[whot]

I can't really think of a good test for this. First, we're only calling out to binaries here, so any actual changes depend on how those binaries work. Second, we're restoring system policy here and that is usually only defined for system files. So to test this, we'd need to install or overwrite an existing system file, then compare the selinux attributes of the previous vs newly installed file. I don't think that's a good option.

[codecov-io]

Codecov Report

Merging #2137 into master will decrease coverage by 0.05%.
The diff coverage is 0%.

@@            Coverage Diff            @@
##           master   #2137      +/-   ##
=========================================
- Coverage   64.06%     64%   -0.06%     
=========================================
  Files          72      72              
  Lines       17235   17250      +15     
  Branches     3555    3556       +1     
=========================================
  Hits        11041   11041              
- Misses       5102    5117      +15     
  Partials     1092    1092

Impacted Files	Coverage Δ
mesonbuild/scripts/meson_install.py	0% <0%> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7f307fd...72909ef. Read the comment docs.

[astavale]

I find the phrase "disabling SELinux" in "{!r}: Failed to restore SELinux context, disabling SELinux..." alarming. Disabling SELinux means editing /etc/selinux/config in some distros or adding selinux=0 as a kernel parameter to your boot loader. For an example see How do I turn SELinux off in Red Hat Enterprise Linux?.

There is no way that Meson should be that invasive. I'm hoping this is just bad phrasing and really what is happening is Meson won't try to use restorecon again if it fails once during that install. May be something like "{!r}: Failed to restore SELinux context, will no longer attempt to restore during this install..." would be better.

[whot]

I'm hoping this is just bad phrasing and really what is happening is Meson won't try to use restorecon again if it fails once during that install.

Yep, sorry, that's just bad phrasing and it does exactly what you wrote. I'll fix this.

[whot]

Force-pushed, new wording is "Failed to restore SELinux context, ignoring SELinux context for all remaining files..."