From e5dfca6c88e338eabc5959ad168d038f438e9f2d Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Tue, 11 Nov 2025 21:13:33 +0000
Subject: [PATCH] Fix SELinux compatibility in host agent installer

Replace mv with install command to ensure correct SELinux context.
The mv command preserves the user_tmp_t label from /tmp, which
prevents systemd from executing the binary on SELinux systems.

The install command creates a new file with the correct label for
/usr/local/bin. Added automatic restorecon call for SELinux systems
to ensure policy compliance.

Related to #688
---
 scripts/install-host-agent.sh | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/scripts/install-host-agent.sh b/scripts/install-host-agent.sh
index 132b7d9..ca292dd 100755
--- a/scripts/install-host-agent.sh
+++ b/scripts/install-host-agent.sh
@@ -386,8 +386,18 @@ else
     log_info "Checksum not available (server doesn't provide it yet)"
 fi
 
-sudo mv "$TEMP_BINARY" "$AGENT_PATH"
-sudo chmod +x "$AGENT_PATH"
+# Use install command instead of mv to ensure correct SELinux context
+# The install command creates a new file with the correct label for the target directory
+sudo install -m 0755 "$TEMP_BINARY" "$AGENT_PATH"
+rm -f "$TEMP_BINARY"
+
+# On SELinux systems, explicitly restore context to ensure policy compliance
+if command -v selinuxenabled &> /dev/null && selinuxenabled 2>/dev/null; then
+    if command -v restorecon &> /dev/null; then
+        sudo restorecon -F "$AGENT_PATH" 2>/dev/null || true
+    fi
+fi
+
 log_success "Agent binary installed to $AGENT_PATH"
 
 # Build reusable agent command strings