Start virtiofsd with --security-label

This makes sure selinux relabeling works as expected when booting
off virtiofs

diff --git a/mkosi/qemu.py b/mkosi/qemu.py
index 68ed168bece56008c08853df8b4d3b845e6be73b..fbf403b67de711a2bd7d07d7c469922d9e78993f 100644 (file)
--- a/mkosi/qemu.py
+++ b/mkosi/qemu.py
@@ -322,6 +322,9 @@ def start_virtiofsd(config: Config, directory: Path, *, uidmap: bool) -> Iterato
         "--sandbox=chroot",
     ]
 
+    if not uidmap:
+        cmdline += ["--security-label"]
+
     # We create the socket ourselves and pass the fd to virtiofsd to avoid race conditions where we start qemu
     # before virtiofsd has had the chance to create the socket (or where we try to chown it first).
     with (