Load the SELinux policy after switch_root and remove the selinux-loadpolicy module

modules.d/98selinux/selinux-loadpolicy.sh

@@ -1,6 +1,9 @@
 #!/bin/sh
 
-# FIXME: load selinux policy.  this should really be done after we switchroot
+# SELinux policy load should be done after switch_root.
+#
+# This module is therefore obsolete and it is left here only
+# for backwards compatibility.
 
 rd_load_policy() {
     # If SELinux is disabled exit now

modules.d/99base/init.sh

@@ -5,6 +5,7 @@
 # Copyright 2008-2010, Red Hat, Inc.
 # Harald Hoyer <[email protected]>
 # Jeremy Katz <[email protected]>
+# Copyright 2024 Guido Trentalancia <[email protected]>
 
 export -p > /tmp/export.orig
 
@@ -397,3 +398,63 @@ else
         emergency_shell
     }
 fi
+
+# If SELinux is disabled exit now
+getarg "selinux=0" > /dev/null && return 0
+
+SELINUX="enforcing"
+# shellcheck disable=SC1090
+[ -e "/etc/selinux/config" ] && . "/etc/selinux/config"
+
+# Check whether SELinux is in permissive mode
+permissive=0
+
+if getarg "enforcing=0" > /dev/null || [ "$SELINUX" = "permissive" ]; then
+    permissive=1
+fi
+
+# Finally load the SELinux policy and perform relabeling if needed
+if [ -x "/sbin/load_policy" ] || [ -x "/usr/sbin/load_policy" ]; then
+    local ret=0
+    local out
+    info "Loading SELinux policy"
+
+    if [ -x "/sbin/load_policy" ]; then
+        out=$(LANG=C /sbin/load_policy -i 2>&1)
+        ret=$?
+        info "$out"
+    else
+        out=$(LANG=C /usr/sbin/load_policy -i 2>&1)
+        ret=$?
+        info "$out"
+    fi
+    umount /sys/fs/selinux
+
+    if [ "$SELINUX" = "disabled" ]; then
+        return 0
+    fi
+
+    if [ $ret -eq 0 ] || [ $ret -eq 2 ]; then
+        # If machine requires a relabel, force to permissive mode
+        [ -e "/.autorelabel" ] && LANG=C /usr/sbin/setenforce 0
+        mount --rbind /dev "/dev"
+        LANG=C /sbin/restorecon -R /dev
+        umount -R "/dev"
+        return 0
+    fi
+
+    warn "Initial SELinux policy load failed."
+    if [ $ret -eq 3 ] || [ $permissive -eq 0 ]; then
+        warn "Machine in enforcing mode."
+        warn "Not continuing"
+        emergency_shell -n selinux
+        exit 1
+    fi
+    return 0
+elif [ $permissive -eq 0 ] && [ "$SELINUX" != "disabled" ]; then
+    warn "Machine in enforcing mode and cannot execute load_policy."
+    warn "To disable selinux, add selinux=0 to the kernel command line."
+    warn "Not continuing"
+    emergency_shell -n selinux
+    exit 1
+fi