Label /var/lib/systemd/pstore as secret_t, include in logdog

[ginglis13]

Issue number:

Closes #1027

Description of changes:

Label /var/lib/systemd/pstore as secret_t and include this content in logdog bundle

Testing done:

1. Launch Bottlerocket instance with pstore-enabled core-kit
2. Validate SELinux label on /var/lib/systemd/pstore
3. Trigger kernel panic via sysrq-trigger
4. After reboot, verify systemd-pstore archived crash data
5. Run logdog and verify pstore data is captured in support bundle

Validate SELinux label:

$ ls -Zd /var/lib/systemd/pstore
system_u:object_r:secret_t:s0 /var/lib/systemd/pstore

Triggered panic via:

apiclient exec admin sheltie tee /proc/sys/kernel/sysrq <<< 1
apiclient exec admin sheltie tee /proc/sysrq-trigger <<< c

Post-crash:

$ ls -laZ /var/lib/systemd/pstore/1788309035/001/
system_u:object_r:secret_t:s0 .
system_u:object_r:secret_t:s0 dmesg-efi_pstore-178830903501001
system_u:object_r:secret_t:s0 dmesg-efi_pstore-178830903502001
...
system_u:object_r:secret_t:s0 dmesg-efi_pstore-178830903516001
system_u:object_r:secret_t:s0 dmesg.txt

All archived files inherit secret_t label.

Instance rebooted successfully after crash. After reboot, systemd-pstore.service ran successfully:

● systemd-pstore.service - Platform Persistent Storage Archival
     Active: active (exited) since Wed 2026-09-02 00:30:48 UTC
   Main PID: 1371 (code=exited, status=0/SUCCESS)

Journal output confirmed 16 EFI pstore dmesg chunks were moved from /sys/fs/pstore/ to /var/lib/systemd/pstore/1788309035/001/. Additionally, a reassembled dmesg.txt was created containing the complete kernel log from boot through panic.

The panic trace in dmesg.txt clearly shows:

<4>[  157.354265] Hardware name: Amazon EC2 c6i.large/, BIOS 1.0 10/16/2017
<4>[  157.355144] Call Trace:
<4>[  157.355489]  <TASK>
<4>[  157.355760]  panic+0x317/0x370
<4>[  157.356164]  ? _printk+0x58/0x80
<4>[  157.356602]  sysrq_handle_crash+0x16/0x20
<4>[  157.357149]  __handle_sysrq+0xd0/0x190
<4>[  157.357663]  write_sysrq_trigger+0x55/0x70

Logdog output confirmed the new glob was executed:

Checking: /usr/share/logdog.d/logdog.common.conf
...
Running: glob /var/log/kdump/*
Running: glob /var/lib/systemd/pstore/*
...
logs are at: /var/log/support/bottlerocket-logs.tar.gz

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.