From a79553530592883fa6e0fd6793fe813c3b74b43f Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Mon, 31 Aug 2026 13:45:06 +0200
Subject: [PATCH] fix(configuration): disable selinux with selinux=0 on el9
 when the feature is off

---
 roles/configuration/tasks/grub.yml    | 6 +++++-
 roles/configuration/tasks/selinux.yml | 8 +++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/roles/configuration/tasks/grub.yml b/roles/configuration/tasks/grub.yml
index a8c73b9..69da734 100644
--- a/roles/configuration/tasks/grub.yml
+++ b/roles/configuration/tasks/grub.yml
@@ -43,11 +43,14 @@
           }}
         grub_root_flags: >-
           {{ ['rootflags=subvol=@'] if system_cfg.filesystem == 'btrfs' else [] }}
+        grub_selinux_args: >-
+          {{ [] if system_cfg.features.selinux.enabled | bool else ['selinux=0'] }}
         # String-concat (not list-concat like grub_kernel_cmdline_base below): ansible-lint's
         # jinja render trips on list+list when grub_lvm_args leads the expression here.
         grub_cmdline_linux_base: >-
           {{
-            ((grub_lvm_args | join(' ')) ~ ' ' ~ (_hardware_profile_kernel_params | default([]) | join(' '))) | trim
+            ((grub_lvm_args | join(' ')) ~ ' ' ~ (grub_selinux_args | join(' ')) ~ ' '
+             ~ (_hardware_profile_kernel_params | default([]) | join(' '))) | trim
           }}
         grub_kernel_cmdline_base: >-
           {{
@@ -57,6 +60,7 @@
               + ['ro']
               + grub_lvm_args
               + grub_root_flags
+              + grub_selinux_args
               + (_hardware_profile_kernel_params | default([]))
             )
             | join(' ')
diff --git a/roles/configuration/tasks/selinux.yml b/roles/configuration/tasks/selinux.yml
index 4883cbb..e761fa5 100644
--- a/roles/configuration/tasks/selinux.yml
+++ b/roles/configuration/tasks/selinux.yml
@@ -22,10 +22,12 @@
         mode: "0644"
 
     # Fedora: setfiles segfaults during bootstrap chroot relabeling, so SELinux
-    # is left permissive and expected to relabel on first boot.
-    - name: Disable SELinux
+    # is left permissive and expected to relabel on first boot. Opting out writes
+    # disabled here and selinux=0 on the kernel cmdline (grub.yml), the only form
+    # EL9 honours.
+    - name: Set the SELinux mode
       when: os == "fedora" or not system_cfg.features.selinux.enabled | bool
       ansible.builtin.lineinfile:
         path: /mnt/etc/selinux/config
         regexp: ^SELINUX=
-        line: SELINUX=permissive
+        line: "SELINUX={{ 'permissive' if system_cfg.features.selinux.enabled | bool else 'disabled' }}"