document behavior of --selinux-relabel

the description of the --selinux-relabel option suggests that it
perform an immediate relabel, when in fact it may (and probably will)
instead simply touch /.autorelabel on the image, which schedules a
relabel operation for the next time the image boots.  This can be
surprising because it results both in an extended initial boot time
*and* results in an automatic reboot (on some distributions).
This commit is contained in:
Lars Kellogg-Stedman
2016-03-24 15:21:45 -04:00
committed by Richard W.M. Jones
parent 6cdd20716c
commit c6512ead45

View File

@@ -523,6 +523,10 @@ C</etc/pam.d/common-password> (Debian, Ubuntu).";
flag_pod_longdesc = "\
Relabel files in the guest so that they have the correct SELinux label.
This will attempt to relabel files immediately, but if the operation fails
this will instead touch F</.autorelabel> on the image to schedule a
relabel operation for the next time the image boots.
You should only use this option for guests which support SELinux.";
};