[yocto] [meta-selinux] all files unlabeled_t when using squashfs

[Josh_Pennell at Dell.com]

Hello,

I'm working on a project using the meta-selinux reference policy on an embedded system.  The device uses a squashfs file system that is labeled during build time.  During the build, policy file labels are applied using Pseudo and setfiles with an alternate root path specified.  Also if I modify the build to use sudo setfiles I can confirm the file tags are correct.

Currently this is being done with Yocto 1.3 for prototyping on some older hardware but moving forward Yocto 1.7 will be used.

Using a Fedora system it is possible to mount the squashfs file and confirm the file labels are correct.  When the target system is flashed the file labels for the squashfs files are incorrect, but ram disk files are correct.  Using ls -laZ, all squashfs files are system_u:object_r:unlabeled_t

The kernel .config values for squsahfs and selinux here here

CONFIG_SQUASHFS=y
CONFIG_SQUASHFS_XATTR=y
CONFIG_SQUASHFS_ZLIB=y
CONFIG_SQUASHFS_LZO=y
CONFIG_SQUASHFS_XZ=y
# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set
CONFIG_SQUASHFS_EMBEDDED=y
CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=10

CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
CONFIG_SECURITY_SELINUX_DISABLE=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX=n
# CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set

Has anyone else run into this problem?  Any suggestions on what may be wrong?

Regards,
josh

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.yoctoproject.org/pipermail/yocto/attachments/20141103/48b4984a/attachment.html>