labeled-squashfs

Documentation

Overview

Package main builds a SELinux-labeled squashfs image without requiring fakeroot or write access to security.* xattrs on the source tree.

It walks the source rootfs, looks up each path's SELinux context against the supplied file_contexts, and emits a mksquashfs pseudo-file definition list. mksquashfs is then invoked with -xattrs-exclude '.*' so it ignores any xattrs on the source filesystem and -pf <pseudo> so it embeds the SELinux labels directly into the image.

This is the equivalent, for the rootfs build, of what siderolabs/talos PR #13075 did for extension compression.