maintain selinux attributes into the erofs build

scripts/extract-artifacts.sh

@@ -37,7 +37,7 @@ ROOT_HASH_UUID=${ROOT_HASH_UUID:-f1ee7000-0000-4000-8000-000000000002}
 ROOT_DATA_DEV="/dev/disk/by-id/nvme-uuid.${ROOT_DATA_UUID}"
 ROOT_HASH_DEV="/dev/disk/by-id/nvme-uuid.${ROOT_HASH_UUID}"
 
-for bin in virt-copy-out virt-tar-out virt-ls mkfs.erofs veritysetup jq; do
+for bin in virt-copy-out virt-ls guestfish mkfs.erofs veritysetup jq getfattr; do
     command -v "$bin" >/dev/null || { echo "ERROR: $bin not found on build host" >&2; exit 1; }
 done
 
@@ -54,12 +54,29 @@ virt-copy-out -a "$QCOW2" "/boot/$KERNEL" "/boot/initramfs-generic.img" "$OUT/"
 mv "$OUT/$KERNEL" "$OUT/vmlinuz"
 mv "$OUT/initramfs-generic.img" "$OUT/initramfs.img"
 
-echo "==> Exporting root tree"
-virt-tar-out -a "$QCOW2" / "$WORK/rootfs.tar"
+echo "==> Exporting root tree (preserving SELinux labels + xattrs)"
+# SELinux labels MUST survive into the erofs, or the enforcing target denies the
+# login session — you authenticate, then logind kills the session, and a
+# read-only erofs can't autorelabel to fix itself. guestfish tar-out with
+# selinux:true/xattrs:true captures security.selinux; the extraction restores it
+# (--xattrs), and mkfs.erofs preserves xattrs into the image. (The old
+# virt-tar-out + plain `tar -xpf` dropped the labels — that was the login bug.)
+guestfish --ro -a "$QCOW2" -i \
+    tar-out / "$WORK/rootfs.tar" numericowner:true xattrs:true selinux:true acls:true
 mkdir "$WORK/root"
-tar -C "$WORK/root" --numeric-owner -xpf "$WORK/rootfs.tar"
+tar -C "$WORK/root" --numeric-owner --xattrs --xattrs-include='*' --acls --selinux \
+    -xpf "$WORK/rootfs.tar"
 rm -rf "$WORK/root/boot/"* "$WORK/rootfs.tar"   # diskless hosts don't need /boot
 
+# Fail loudly if labels didn't make it — shipping an unlabeled enforcing image
+# boots but denies all logins (the symptom we just chased down).
+if ! getfattr -h -n security.selinux "$WORK/root/usr/bin/bash" >/dev/null 2>&1; then
+    echo "ERROR: SELinux label missing on /usr/bin/bash in the extracted tree." >&2
+    echo "       An enforcing boot would deny login. Check guestfish/tar xattr flags." >&2
+    exit 1
+fi
+echo "==> SELinux labels preserved (bash: $(getfattr -h --only-values -n security.selinux "$WORK/root/usr/bin/bash" 2>/dev/null))"
+
 echo "==> Building reproducible erofs image"
 # UNCOMPRESSED on purpose: the target Rocky 9 kernel's erofs is built without
 # CONFIG_EROFS_FS_ZIP, so mounting a compressed image fails at boot with