Does `mv --context` (for selinux, a.k.a. -Z) correctly apply labels recursively to directory contents?

Question

mv -Z applies the default selinux context. Does it differ from all other invocations of mv, and work on all the files in a moved directory individually?

Answer 1

Yes.

$ mkdir a
$ touch a/b
$ ls -Z -d a a/b
unconfined_u:object_r:user_home_t:s0 a
unconfined_u:object_r:user_home_t:s0 a/b
$ strace -f mv -Z a ~/.local/share/Trash/files
...
open("/home/alan/.local/share/Trash/files/a/b", O_RDONLY|O_NOFOLLOW) = 3
...
fgetxattr(3, "security.selinux", "unconfined_u:object_r:user_home_t:s0", 255) = 37
fsetxattr(3, "security.selinux", "unconfined_u:object_r:data_home_t:s0", 37, 0) = 0
...
$ cd ~/.local/share/Trash/files
$ ls -Zd a a/b
unconfined_u:object_r:data_home_t:s0 a
unconfined_u:object_r:data_home_t:s0 a/b

---

This also introduced the possibility that moving a directory within a single filesystem will fail part-way through. I.e. due to lack of disk space when changing the labels. The impact of this is mitigated as the relabel happens as a second step. The initial move operation is still by a single atomic rename. This means the labels would be inconsistent, but the files will be consistent in every other way. It should be simple to fix the labels once space becomes available.