From 7354d6a49422fc1ba2f0fd69665e199d0028f4a0 Mon Sep 17 00:00:00 2001
From: Saya Andy <saya.andy@posteo.com>
Date: Thu, 5 Nov 2026 19:33:57 +0400
Subject: fix: reproduce rpm_transition_script for the kiwi domain to allow iso
 building with newer kiwi-ng and rpm

---
 .gitignore                 |  2 ++
 README.md                  | 15 ++++++++++++++-
 selinux/kiwi-rpm-script.te | 39 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 selinux/kiwi-rpm-script.te

diff --git a/.gitignore b/.gitignore
index c96fb51..d0f8c0c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 outdir-build/
 outdir/
+selinux/*.pp
+selinux/*.mod
diff --git a/README.md b/README.md
index 94d4266..c8def65 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ I bought this device as I viewed it as a great Linux GNOME tablet, but after sev
 
 **The compiled ISOs can be downloaded [here](https://dist.sayag.it/fedora/45/aarch64).**
 
-This KIWI project is built mainly on the base of Fedora Workstation 45 (Pre-release) LiveCD ISO. Trying a stable version (the latest is Fedora 44 at the time of writing this) is possible, but not tested for now.
+This KIWI project is built mainly on the base of Fedora Workstation 45 LiveCD ISO.
 
 If you want to compile this image manually, **the build arch must be `aarch64`**. It means that if you are on an `amd64` machine, you would have to use aarch64 instructions emulation tools like `binfmt`. Unfortunately, such a tool will drastically increase the compilation time.
 
@@ -34,6 +34,19 @@ To build this on Fedora Linux:
 []$ sudo ./kiwi-build --kiwi-file=Fedora.kiwi --image-type=iso --image-profile=Workstation-Live --output-dir ./outdir
 ```
 
+### SELinux issues
+
+In the combo of kiwi-ng 11.1.1 and rpm 6.1.0 (latest versions in Fedora 45 by November 5th 2026), rpm runs %sysusers scriptlets through an exec content of rpm_script_t, and with kiwi.te having no such grant, the host enforcement denies the domain transition, resulting in `setup` pkg, and many more, not getting installed inside the build environment.
+
+To fix the issue, reproduce rpm_transition_script for the kiwi domain. There is a script to do exactly this in `selinux/` domain. Do this to proceed with ISO build:
+
+```bash
+cd selinux
+checkmodule -M -m -o kiwi-rpm-script.mod kiwi-rpm-script.te
+semodule_package -o kiwi-rpm-script.pp -m kiwi-rpm-script.mod
+sudo semodule -i kiwi-rpm-script.pp
+```
+
 ## Feature matrix
 
 | Hardware | State | Nuances |
diff --git a/selinux/kiwi-rpm-script.te b/selinux/kiwi-rpm-script.te
new file mode 100644
index 0000000..af2444a
--- /dev/null
+++ b/selinux/kiwi-rpm-script.te
@@ -0,0 +1,39 @@
+# Host-side SELinux fix for building with kiwi-ng 11.1.1 on Fedora (kiwi-selinux).
+#
+# kiwi-selinux installs a policy that runs /usr/bin/kiwi-ng in the kiwi_t
+# domain. rpm 6.1 runs %sysusers scriptlets with an rpm_script_t exec
+# context (fedora-selinux rpm_transition_script()).  kiwi.te never grants
+# that transition, so every sysusers scriptlet dies with exit status 127
+# ("command not found" from the exec failure), which is what breaks the
+# bootstrap transaction: setup-* fails, /etc/passwd and /etc/group are never
+# created, and all later user/group lookups fail.
+#
+# This module reproduces fedora's rpm_transition_script(kiwi_t, unconfined_r)
+# for the kiwi domain.  Not part of the image build - install it on the host:
+#
+#   checkmodule -M -m -o kiwi-rpm-script.mod kiwi-rpm-script.te
+#   semodule_package -o kiwi-rpm-script.pp -m kiwi-rpm-script.mod
+#   sudo semodule -i kiwi-rpm-script.pp
+
+module kiwi-rpm-script 1.0;
+
+require {
+	type kiwi_t;
+	type rpm_script_t;
+	attribute rpm_transition_domain;
+	attribute_role rpm_script_roles;
+	role unconfined_r;
+	class process { transition sigchld };
+	class fd use;
+	class fifo_file { read write getattr ioctl };
+}
+
+# rpm_transition_script(), expanded for kiwi_t / unconfined_r
+typeattribute kiwi_t rpm_transition_domain;
+roleattribute unconfined_r rpm_script_roles;
+
+allow kiwi_t rpm_script_t:process transition;
+allow kiwi_t rpm_script_t:fd use;
+allow rpm_script_t kiwi_t:fd use;
+allow rpm_script_t kiwi_t:fifo_file { read write getattr ioctl };
+allow rpm_script_t kiwi_t:process sigchld;
-- 
cgit v1.3.1+17