[PATCH] Revert "dns-hatchet: apply resolv.conf's selinux context to new resolv.conf"
Jason A. Donenfeld
Jason at zx2c4.com
Fri Jun 12 17:04:47 UTC 2026
On Mon, Jun 08, 2026 at 03:36:10PM +0200, Robert Frohl wrote:
> This reverts commit 2ce4680bd34f371aacd3c09673c3c907274321cd.
>
> selinux does not allow every domain to set file contexts and will raise
> relabelto/relabelfrom AVCs and block these changes if a domain tries to update
> the selinux context.
>
> It is better to ignore selinux and leave the proper labeling to the
> selinux policy, which can add proper file transitions for the right
> context.
Does any existent selinux policy have anything to handle this? Or is this
purely speculative/future-facing?
Also, wondering if any distros are still shipping the hatchet.
More information about the WireGuard
mailing list