[solved] SELinux - should I "touch /.autorelabel" when preparing/sealing a virtual machine for use as a template?

[Aqualinx]

Hello and thank you for taking the time to read my post.

I have created a CentOS 7-1611 virtual machine in oVirt which I would like to turn into a template. I have read the oVirt documentation on doing so (http://www.ovirt.org/documentation/vmm- ... Templates/) and have referenced additional posts on the topic, including:

• https://lonesysadmin.net/2013/03/26/pre ... plate-vms/
• http://www.linuxquestions.org/questions ... 175533911/

On the latter page TX_SCUBA states that it is "Always good to do an SELinux relabel: touch /.autorelabel", but I see no mention of it in either the oVirt documentation or the first page referenced above. I have Googled and searched these fora and have not found additional recommendations on whether to do this and why.

An answer specifying best practice when creating virtual machine templates, whether this is universal or VMware specific and why would be most appreciated!

Thank you,
Charles

[TrevorH]

The VM disk that you create ought to already have the correct selinux contexts and should not need altering. The only time this won't be true is if you use a non-selinux aware operating system to modify the image. The only drawback to using touch /.autorelabel is that it takes extra time to run. Oh, and if you've made any overriding changes to selinux contexts using chcon instead of semanage then they would be reverted to default values.

[Aqualinx]

Thank you TrevorH for such a quick reply! The only modification I can see doing right now in modifying the image is using cloud-init. I see a post on the RHEL customer portal (https://access.redhat.com/solutions/1381623) with the title "cloud-init partially fails with SELinux in enforced mode" but cannot read it as I/the company I work for is not a subscriber. Would this be an instance of using "a non-selinux aware operating system to modify the image"?

Thanks again!
Charles

[TrevorH]

If this happened to be for a development project then you could read http://developers.redhat.com/blog/2016/ ... available/