Currently, emerge --config might not work as expected in SELinux profiles as emerge by default runs in the (confined) portage_t domain, whereas the pkg_config() phase of ebuilds generally require system administration privileges. Reproducible: Always Going to see if we can support emerge --config without transition while keeping portage_t for regular operations. Looks like this *might* work if /usr/lib/portage/bin/ebuild{.sh} are labeled bin_t instead of portage_exec_t, but that does mean that the developer "functionality" offered by those tools needs to be tackled.
Looks like the "simplest" approach is that: - Users who need to call "emerge --config" use runcon to force the domain to remain in sysadm_t - The ebuild and ebuild.sh scripts are marked as bin_t - Developers can call "ebuild" with runcon as well Needed policy changes: can_exec(sysadm_t, portage_tmp_t) # Portage does an exectest allow portage_t bin_t:file entrypoint; /usr/lib/portage/bin/ebuild{,.sh} marked as bin_t Best is to document this in the Gentoo SELinux handbook (developers section or so) Going to look for other possibilities now as well.
r3 is now in the tree, ~arch'ed
r4 is now stable in the tree