Issue

• Relabeling the system doesn't apply the expected contexts, as shown in the example below, even though there is no SELinux customization

  • No SELinux customization

    # semanage fcontext -C -l
    #
    

  • matchpathcon prints a different context than the one applied after having relabeled the system

    # matchpathcon /
    /   system_u:object_r:root_t:s0
    
    # ls -Zd /
    dr-xr-xr-x. root root system_u:object_r:admin_home_t:s0 /
    

• Running /sbin/fixfiles manually to relabel the system prints the filespec_add message shown below

  # /sbin/fixfiles restore
  Warning: Skipping the following R/O filesystems:
  /sys/fs/cgroup
  Relabeling / /boot /dev ...
  filespec_add:  conflicting specifications for /root and /, using system_u:object_r:root_t:s0.
  100.0%
  Cleaning up labels on /tmp
  

• Many system services fail to start at boot, including systemd-logind, dbus, polkit and NetworkManager

  [ INFO ] Network Manager is not active.
  [DEPEND] Dependency failed for Network Manager Wait Online.
  ...
  [FAILED] Failed to start Authorization Manager.
  See 'systemctl status polkit.service' for details.
  ...
  [FAILED] Failed to start Login Service.
  See 'systemctl status systemd-logind.service' for details.
  ...
  [  OK  ] Started D-Bus System Message Bus.
           Starting D-Bus System Message Bus...
  ...
  [  OK  ] Started D-Bus System Message Bus.
           Starting D-Bus System Message Bus...
  ...