selinux related question on RPM upgrade on opensuse-MicroOS

[DirkDatzert]

Hello, I build an RPM paket for k3s for myself.
During Transactional-Upgrades I see the following hint:

/var/lib/rancher/k3s/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots not reset as customized by admin to unconfined_u:object_r:container_file_t:s0

selinux is activeted and k3s-selinux is installed.

k3s is installed and working as expected, but I want to understand whats going on maybe I have to change something in my buildprocess of the rpm.

Thanks for feedback and best regards

Dirk

[DirkDatzert]

After two years I gave Copilot a try to answer my question:

This is expected behavior with SELinux + transactional-update and not a k3s issue.
The warning means:
→ the system tried to reset SELinux labels during the RPM transaction
→ but skipped it because the files are detected as “customized by admin”
For k3s this happens because:

/var/lib/rancher/k3s/.../snapshots is runtime data (containerd overlayfs)
labels like container_file_t are set dynamically at runtime
transactional-update sees them as “modified” and does not overwrite them

As long as:

k3s works
no AVC denials appear

→ this warning is harmless
Recommendation:
Do not package or relabel /var/lib/rancher/k3s/* in your RPM. It’s runtime state and should be left to k3s/containerd + k3s-selinux.