Default file context specification for /run/systemd/generator.early
has been set as an equivalency to /usr/lib/systemd/system,
similar to existing entries for generator and generator.late.
This was previously needed because on RPM-OSTree systems, user homes
were located in `/var/home` while the default home specified in
`etc/default/useradd` was still `/home`. This meant that `genhomedircon`
(which parses `/etc/default/useradd` to find the homedir) rendered the
`HOME_DIR` template rules as `/home` into `file_contexts.homedirs`. So
then, we needed this equivalency rule so that `/var/home/...` was
equivalent to the generated `/home/...` rules.
Now however, RPM-OSTree correctly fixes `/etc/default/useradd` to point
to `/var/home` [1]. This now means that `file_contexts.homedirs` does
correctly hold `/var/home/...` rules. Thus we no longer need this
equivalency rule. In fact, it now actively prevents proper labeling of
the home dirs since `/home/...` is now considered `default_t` [2]. If
anything, we'd want the *inverse* rule of `/home --> `/var/home`, but
only on RPM-OSTree systems, which I'm not sure how easy it'd be to do
here. In practice, since SELinux uses the resolved path before matching
a rule, all paths under `/home/...` will end up as `/var/home/...`.
IOW, the hack we added to make `/var/home` labeled like `/home` on
RPM-OSTree systems is no longer needed now that RPM-OSTree correctly
sets `HOME`, which SELinux picks up on.
As for root's home, it's part of the main context list and isn't
templated, so it's always `/root`, and so we do still need the
equivalency rule there.
[1] https://github.com/projectatomic/rpm-ostree/pull/1726
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1669982
Zdenek Pytela
Juraj Marcin
Jonathan Lebon
Lukas Vrabec
Dan Walsh
Miroslav Grepl