selinux_install.sh

#!/usr/bin/bash

set -euo pipefail

print_selinux_labels() {
        # ls -Z and getfattr will show unlabeled_t because the kernel gets in the way
        # and maps the security attributes with the database.
        # Read the raw bytes instead using debugfs
        fpath=$(realpath "${1}")
        partition="/dev/sda4"  # update to match the fs partition for the current directory
        echo ":: Getting security.selinux attributes for $fpath via debugfs on $partition"
        sudo debugfs -R "ea_get $fpath security.selinux" "${partition}"
}

tmpdir=$(mktemp -d -p .)
cleanup() {
        rm -rf "${tmpdir}"
}
trap cleanup EXIT

# This file will receive an arbitrary selinux label
targetfile="${tmpdir}/somefile"
touch "${targetfile}"

labelscript="${tmpdir}/label.sh"

# Little script that sets the label (so we can give it install_exec_t)
cat > "${labelscript}" << EOF
#!/usr/bin/bash
# Needs sudo for CAP_MAC_ADMIN

sudo chcon -t some_arbitrary_label "${targetfile}"
EOF
chmod +x "${labelscript}"

# label.sh can't set arbitrary labels
echo ":: Running ${labelscript} without install_exec_t"
if ! ${labelscript}; then
        echo ":: Failed successfully \\o/"
fi

print_selinux_labels "${targetfile}"

# Give label.sh install_exec_t
echo ":: Setting install_exec_t on ${labelscript}"
sudo chcon -t install_exec_t "${labelscript}"

echo ":: Running ${labelscript} with install_exec_t"
${labelscript}

print_selinux_labels "${targetfile}"

$ getenforce
Enforcing

$ ./selinux_install.sh
:: Running ./tmp.5IFAiUakUm/label.sh without install_exec_t
chcon: failed to change context of './tmp.5IFAiUakUm/somefile' to ‘unconfined_u:object_r:some_arbitrary_label:s0’: Invalid argument
:: Failed successfully \o/
:: Getting security.selinux attributes for /home/achilleas/tmp.5IFAiUakUm/somefile via debugfs on /dev/sda4
debugfs 1.47.3 (8-Jul-2025)
security.selinux (37) = "unconfined_u:object_r:user_home_t:s0\000"

:: Setting install_exec_t on ./tmp.5IFAiUakUm/label.sh
:: Running ./tmp.5IFAiUakUm/label.sh with install_exec_t
:: Getting security.selinux attributes for /home/achilleas/tmp.5IFAiUakUm/somefile via debugfs on /dev/sda4
debugfs 1.47.3 (8-Jul-2025)
security.selinux (46) = "unconfined_u:object_r:some_arbitrary_label:s0\000"