From: Colin Walters <walters@verbum.org>
Date: Wed, 9 Nov 2022 16:18:36 +0000 (-0500)
Subject: deploy: Don't rebuild selinux policy on first deployment
X-Git-Tag: archive/raspbian/2022.7-2+rpi1^2~13^2^2~20^2
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=bd325061dc9585886f7e60e58d9fc0c8b37e71db;p=ostree.git

deploy: Don't rebuild selinux policy on first deployment

Basically, it should not be necessary - the policy should be
up-to-date.  We don't want to force on continual policy rebuilds.

Even trying to run bwrap when we're *not* in a booted
root can cause failures in nested containerization scenarios.

Closes: https://github.com/ostreedev/ostree/issues/2758
---

diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
index f27ae0e1..26b07080 100644
--- a/src/libostree/ostree-sysroot-deploy.c
+++ b/src/libostree/ostree-sysroot-deploy.c
@@ -2987,12 +2987,12 @@ sysroot_finalize_deployment (OstreeSysroot     *self,
       if (!merge_configuration_from (self, merge_deployment, deployment, deployment_dfd,
                                      cancellable, error))
         return FALSE;
-    }
 
 #ifdef HAVE_SELINUX
-  if (!sysroot_finalize_selinux_policy(deployment_dfd, error))
-    return FALSE;
+      if (!sysroot_finalize_selinux_policy (deployment_dfd, error))
+        return FALSE;
 #endif /* HAVE_SELINUX */
+    }
 
   const char *osdeploypath = glnx_strjoina ("ostree/deploy/", ostree_deployment_get_osname (deployment));
   glnx_autofd int os_deploy_dfd = -1;