From 814d8751c00068e9bf4ea69b23ea0122891632df Mon Sep 17 00:00:00 2001
From: Gilles Coremans <gilles.coremans@redpencil.io>
Date: Mon, 18 May 2026 22:17:43 +0200
Subject: [PATCH] Add an option to disable SELinux separation for the Ember
 container

`edi` always wants to mount the current working directory and various
miscellaneous other directories across the user's homedir. This makes
SELinux relabeling impractical or possibly even harmful as an accidental
invocation of `eds` in ~ could relabel your entire homedir.

The most reasonable fix is just running the Ember container without
SELinux separation. More info:
https://developers.redhat.com/articles/2025/04/11/my-advice-selinux-container-labeling
---
 bin/ed  | 6 +++++-
 bin/edi | 6 +++++-
 bin/eds | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/bin/ed b/bin/ed
index 667210c..02fb7da 100755
--- a/bin/ed
+++ b/bin/ed
@@ -173,9 +173,13 @@ edi_calculate_standard_docker_options() {
                  --volume /app/tmp"
     config_volumes=`edi_calculate_volumes_for_configuration`
     linked_volumes=`edi_calculate_linked_volumes_for_node_modules`
+    if [ -n "$EDI_DISABLE_SELINUX" ]
+    then
+       selinux_disable="--security-opt label=disable"
+    fi
     edi_calculate_ssh_agent_options # SSH_AGENT_OPTIONS
 
-    STANDARD_DOCKER_OPTIONS="$app_volumes $config_volumes $linked_volumes $SSH_AGENT_OPTIONS"
+    STANDARD_DOCKER_OPTIONS="$app_volumes $config_volumes $linked_volumes $selinux_disable $SSH_AGENT_OPTIONS"
 }
 
 # EXPOSES $EDI_DAEMON_CONTAINER_NAME
diff --git a/bin/edi b/bin/edi
index 8433852..b4d035a 100755
--- a/bin/edi
+++ b/bin/edi
@@ -171,9 +171,13 @@ edi_calculate_standard_docker_options() {
                  --volume /app/tmp"
     config_volumes=`edi_calculate_volumes_for_configuration`
     linked_volumes=`edi_calculate_linked_volumes_for_node_modules`
+    if [ -n "$EDI_DISABLE_SELINUX" ]
+    then
+       selinux_disable="--security-opt label=disable"
+    fi
     edi_calculate_ssh_agent_options # SSH_AGENT_OPTIONS
 
-    STANDARD_DOCKER_OPTIONS="$app_volumes $config_volumes $linked_volumes $SSH_AGENT_OPTIONS"
+    STANDARD_DOCKER_OPTIONS="$app_volumes $config_volumes $linked_volumes $selinux_disable $SSH_AGENT_OPTIONS"
 }
 
 # EXPOSES $EDI_DAEMON_CONTAINER_NAME
diff --git a/bin/eds b/bin/eds
index 3385d0b..a449e93 100755
--- a/bin/eds
+++ b/bin/eds
@@ -171,9 +171,13 @@ edi_calculate_standard_docker_options() {
                  --volume /app/tmp"
     config_volumes=`edi_calculate_volumes_for_configuration`
     linked_volumes=`edi_calculate_linked_volumes_for_node_modules`
+    if [ -n "$EDI_DISABLE_SELINUX" ]
+    then
+       selinux_disable="--security-opt label=disable"
+    fi
     edi_calculate_ssh_agent_options # SSH_AGENT_OPTIONS
 
-    STANDARD_DOCKER_OPTIONS="$app_volumes $config_volumes $linked_volumes $SSH_AGENT_OPTIONS"
+    STANDARD_DOCKER_OPTIONS="$app_volumes $config_volumes $linked_volumes $selinux_disable $SSH_AGENT_OPTIONS"
 }
 
 # EXPOSES $EDI_DAEMON_CONTAINER_NAME