Using a different root location for SELinux-aware applications

SELinux-aware applications have more requirements when they run inside a chroot location. They require access to the SELinux subsystem (from within the chroot) and possibly SELinux configuration entries. This includes PAM-enabled services, as user logins on these services might require access to the SELinux user configuration files (such as the seusers file and default contexts).

How to do it…

First, create the regular chroot location as we saw earlier. To update the system to support SELinux-aware applications inside the chroot, complete the following steps:

1. Mount the SELinux filesystem inside the chroot at /sys/fs/selinux/ so that the application can query the SELinux policy:

   ~# mkdir -p /var/chroot/sys/fs/selinux
   ~# mount -t selinuxfs none /var/chroot/sys/fs/selinux
   

2. Optionally, create the /var/chroot/etc/selinux/ location and copy the current definition inside it:

   ~# cp -a /etc/selinux/ /var/chroot/etc/
   

3. Update the seusers file...