# Pre-create chrony's runtime NTP source directory with the CORRECT SELinux label
# at boot, before any NetworkManager event fires. The NM dispatcher
# (10-chrony-dhcp-ntp) writes <iface>.sources here for chronyd's
# `sourcedir /run/chrony-dhcp`.
#
# Why this exists: the dispatcher's own `mkdir -p /run/chrony-dhcp` creates the dir
# as generic `var_run_t`, and the source files inherit it — but `chronyd_t` is only
# allowed to read `chronyd_var_run_t`, so under enforcing SELinux chronyd is DENIED
# reading them and silently loads ZERO sources (bench 2026-07-12, comet-beacon-54:
# NTS never activated — `chronyc authdata` empty; AVC `denied { read } … chronyd_t
# … var_run_t`). The stock RHEL policy already maps /run/chrony-dhcp →
# `chronyd_var_run_t`, and systemd-tmpfiles applies that fcontext when it creates
# the dir here at sysinit (well before the dispatcher runs). Files the dispatcher
# then creates inside inherit `chronyd_var_run_t`, so chronyd can read them — no
# SELinux allow rules needed (verified on the bench).
#
# The distro chrony NM dispatcher (/usr/lib/.../20-chrony-dhcp) used to apply this
# label via a per-file restorecon; we removed it because it clobbered our NTS source
# (see diskless.pkr.hcl + the 10-chrony-dhcp-ntp header), so we restore the labelling
# here instead. Needed in BOTH secure_ntp modes (chronyd must read the sourcedir
# either way).
d /run/chrony-dhcp 0755 root root - -