We're installing RPMs into a CentOS 7 system using Anaconda + Kickstart, which does a
chroot into the target system's environment and installs all of the RPMs we specify in our Kickstart config file. In some of these RPMs, the
%post scriptlets are running the SELinux commands
restorecon to set up our needed SELinux policy.
When installing these RPMs normally (i.e. in an already-installed system), the scriptlets are executing as expected and setting up the SELinux policy on the system. But when we install these RPMs via Anaconda, the commands are succeeding, but none of the SELinux policy actually takes effect in the installed system upon a reboot: none of the modules installed via
semodule are installed, and none of the context mappings configured via
semanage are in place.
For example, we have a module
mymodule.pp which we install in our
%post script via
semodule -i mymodule.pp and a file context mapping definition that we set as
semanage fcontext -a -t mysqld_db_t '/storage/export(/.*)?'; these commands "succeed" during the Anaconda install, but upon rebooting into the actual system, none of the policies are in place.
So this brings my question: when I manage my system's SELinux policy using e.g.
restorecon, are these commands managing the currently running kernel? Is that why they're not being seen in the newly-installed system? Or might I have something else going on here? I would have figured that running these commands would put/changed a file in the filesystem that would get read by the (newly-installed) kernel on boot to set the policy and contexts.