Disabling Yum's PostInst RestoreCon Action

Question

When I update the package "selinux-policy-targeted" on a Fedora 15 box, as part of yum's post-inst action, a restorecon of the entire disk is called to change the on-disk selinux contexts to match the new rules. However, I have a server with a sizable disk array, with an extraordinary amount of small files, and there is a fairly high IO load most of the time, so this action takes an inordinately long time (read: literally multiple days) to perform this action.

Is there any way to force this restorecon to not take place, or at least let me exclude a directory tree from this action so I can update the OS's contexts for things that matter (i.e. configuration directories, etc) but not for my data...

Answer 1

Well, there is option to exclude folder (-e) when you manually invoke the restorecon command, however when it is invoked automatically, it references the restorecond.conf file and reapply the contexts. I suppose you have this large amount of data inside your user home directory, and the ~/* inclusion in the restorecond.conf will be the one that you need to tweak, as there is no option to exclude any folder via this conf, unfortunately.

Answer 2

The package doesn't do a complete relabel in %post, as that would be insane for lots of people ... it does:

restorecon -R /root /var/log /var/lock /var/run 2> /dev/null

...is there some reason that is including your backups?