Debug: soft-reboot [ 388.410231] systemd[1]: Failed to load new SELinux policy. Continuing with old policy.

[jmarrero]

We see

systemd[1]: Failed to load new SELinux policy. Continuing with old policy.

When performing soft-reboots even if the image has not changed any policy files.

opens use seems to have similar constraints with relabeling:
https://microos.opensuse.org/blog/2024-06-13-soft-reboot/

We need to debug this a bit more and consult with SELinux folks to see if this just needs to be documented or if it's an issue we need to address somewhere in the stack.

[jmarrero]

Chatted yesterday with @msekletar & @lnykryn (I hope I got your profiles right). It seems like this error is expected as SELinux can't really load a new policy without a hard reboot if I understood correctly maybe we could load policy modules but not a full one.

Also it was floated that maybe we need to check for policy changes like we do for the kernel. I am not sure how feasible this is.

[cgwalters]

Also it was floated that maybe we need to check for policy changes like we do for the kernel. I am not sure how feasible this is.

We actually asked for selinux to learn to do change detection as part of edb4f38

Though honestly by far the simplest thing here is to be conservative and just check if any files at all are changed in /etc/selinux or so (between the two base trees).