Need to label a directory created at runtime just before the selinux policy is loaded

[Rajeshvce]

I want to label a directory to root_t context in initramfs in debian12 just before the selinux policy is loaded . Is it possible to do it ?
Can anyone please help me out of this.

[bachradsusi]

File systems are labeled using extended attributes, see
https://github.com/SELinuxProject/selinux-notebook/blob/main/src/objects.md#labeling-extended-attribute-filesystems

You can use chcon to label files:

# sestatus 
SELinux status:                 disabled
# mkdir /tmp/new-root
# ls -dZ /tmp/new-root/
? /tmp/new-root/
# chcon system_u:object_r:root_t:s0 /tmp/new-root/
# ls -dZ /tmp/new-root/
system_u:object_r:root_t:s0 /tmp/new-root/

[Rajeshvce]

If I am not wrong, selinux utilities like chcon, semanage will come into existence only after the selinux policy is loaded right. Is there any tool that can be used to add context for the unlabeled file before the policy is loaded

[bachradsusi]

Look again at my example above:

• SELinux is disabled and therefore there's no policy loaded
• a new directory is created and ls -Z does not detect any label
• chcon labels the directory
• ls -Z show the label created by chcon