SELinux Context Restoration for LUKS-Encrypted Mounts in Rocky Linux 9

SELinux and LUKS Integration in Rocky Linux 9.x

Rocky Linux 9.4 supports LUKS full-disk encryption via systemd-hibernate and cryptsetup, with XFS as the default filesystem and ext4 on /boot for bootloader compatibility. SELinux enforces mandatory access controls beyond traditional Unix permissions, but the interaction between encrypted volume mounting and SELinux context application remains poorly documented.

The core uncertainty lies in whether SELinux policies automatically restore appropriate security contexts to files within LUKS-encrypted directories after reboot, or if administrators must manually relabel filesystem contexts using restorecon or fixfiles commands. This becomes particularly critical for /home directories which inherit default umask 022, potentially creating world-readable files that bypass intended encryption protections.

Network filesystems like NFS bypass local encryption through kernel keyring limitations, but the question specifically concerns local encrypted volumes. Verification commands exist to check encryption state and boot partition exposure, but no standard procedure exists for auditing SELinux context restoration on encrypted mounts.

• Does Rocky Linux 9.x automatically apply SELinux contexts to LUKS-encrypted volumes during systemd-cryptsetup initialization, or does this require explicit administrator intervention?
• What is the recommended audit procedure to verify that encrypted mount points maintain correct SELinux context inheritance after system reboot?
• Are there documented cases where encrypted volume context restoration conflicts with default policy modules, requiring custom SELinux policy adjustments?