From 4c8a2e5045f45a3a8cae0abe1cf2de74e5509442 Mon Sep 17 00:00:00 2001
From: Jonathan Lebon <jonathan@jlebon.com>
Date: Fri, 6 Mar 2026 16:48:54 -0500
Subject: [PATCH] minimal: Add /var/lib/selinux -> /etc/selinux symlink

On rpm-ostree systems, the SELinux policy store is moved from
`/var/lib/selinux` to `/etc/selinux`. Embed a compatibility symlink so
that tools like chunkah which evaluate rpmdb paths can "see" the move.

See also https://github.com/coreos/rpm-ostree/pull/5572 for more info.

Assisted-by: OpenCode (Claude Opus 4.6)
---
 minimal/finalize.d/01-var.sh | 2 ++
 tests/rootfs/cases/var       | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/minimal/finalize.d/01-var.sh b/minimal/finalize.d/01-var.sh
index 35a8af10..eb5cded0 100755
--- a/minimal/finalize.d/01-var.sh
+++ b/minimal/finalize.d/01-var.sh
@@ -4,4 +4,6 @@ set -xeuo pipefail
 ln -s ../run var/run
 # https://gitlab.com/fedora/bootc/tracker/-/issues/58
 mkdir -p var/lib/rpm-state
+# https://github.com/coreos/rpm-ostree/pull/5572
+ln -s ../../etc/selinux var/lib/selinux
 test -d var/tmp || mkdir -m 1777 var/tmp
diff --git a/tests/rootfs/cases/var b/tests/rootfs/cases/var
index 7c87d32a..6d652989 100755
--- a/tests/rootfs/cases/var
+++ b/tests/rootfs/cases/var
@@ -2,3 +2,6 @@
 set -xeuo pipefail
 # Verify directories we expect to exist
 test -d var/tmp
+# SELinux store compatibility symlink for rpm-ostree systems
+test -L var/lib/selinux
+test "$(readlink var/lib/selinux)" = "../../etc/selinux"