Label the filesystem for SELinux at build time

The image booted. Kernel came up, the device tree loaded — UFS, display,
WiFi and IPA all probed as platform devices — framebuffer console came up, root
mounted off USB and systemd started. Then:

    systemd[1]: Unable to fix SELinux security context of /dev/tty..: Permission denied
    (x hundreds)
    systemd[1]: Too many messages being logged to kmsg, ignoring
    [!!!!!!] Failed to allocate manager object.

The filesystem had no SELinux labels. mke2fs -d carries security.* xattrs
across faithfully, but nothing had ever set them: the tree came from dnf, not
from a running SELinux system. I had relied on /.autorelabel, which cannot
work here — PID 1 dies long before anything acts on the flag.

Label the tree with setfiles instead, after the bind mounts are torn down (or
it would walk the builder's /proc) and before /boot is split out, so /boot's
files are labelled along with everything else. Verified in a privileged
container beforehand that security.selinux xattrs can actually be written
through a bind mount, rather than assuming it.

I had listed policycoreutils in the gongfoo build base for exactly this and
then never called setfiles. It is now also in stage2's fallback toolchain, so
the stock-Fedora path works too.

Ship permissive regardless. The labels make enforcing viable, but the failure
mode is unusually punishing — no login prompt, no shell, nothing to repair from
— and on a machine this awkward to reach that is not a default worth choosing.
SELINUX_MODE in config/device.env flips it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XWRjNJMistCy6ngXH5aJLS

README.md

@@ -122,11 +122,40 @@ docs/                        Installation, firmware, runner setup
 - [docs/firmware.md](docs/firmware.md) — what needs extracting from Windows and why
 - [docs/runner-setup.md](docs/runner-setup.md) — one-time Gitea runner preparation
 
+## Boot status
+
+Confirmed on hardware, from a USB stick:
+
+- GRUB loads the kernel and the device tree
+- The kernel comes up and probes the SDM850 — UFS controller, display
+  subsystem, WiFi and IPA all appear as platform devices, so
+  `DEVICE_CMDLINE` and the DTB are right
+- The framebuffer console works (`simple-framebuffer`, 240x67)
+- The root filesystem mounts and systemd starts
+
+Not yet confirmed: reaching a login prompt, and anything past it. SELinux is
+shipped permissive — see below.
+
+### SELinux
+
+The build labels the filesystem offline with `setfiles`, so enforcing should
+work. It ships **permissive** anyway, because the failure mode is unusually
+punishing: an unlabelled root takes PID 1 down with `Failed to allocate manager
+object` before anything can be logged into and repaired, and `/.autorelabel`
+cannot save it because nothing survives long enough to act on the flag.
+
+Once the machine is up and you are happy with it:
+
+```sh
+sudo setenforce 1                 # try it for this boot
+sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
+```
+
+Or set `SELINUX_MODE=enforcing` in `config/device.env` and rebuild.
+
 ## Caveats
 
-The build has not yet been confirmed to boot on real hardware. The device tree,
-kernel command line and firmware layout are taken from Fedora's Snapdragon WoA
-documentation and the aarch64-laptops project; the parts specific to the C630's
-older SDM850 are reasoned from those rather than tested. Expect to spend a boot
-or two adjusting `DEVICE_CMDLINE` in `config/device.env`. Findings belong in
-this README.
+The kernel command line and firmware layout are taken from Fedora's Snapdragon
+WoA documentation and the aarch64-laptops project; the parts specific to the
+C630's older SDM850 are reasoned from those rather than derived from
+documentation for this machine. Findings belong in this README.