possibly a limitation of overlayFS

Aakdev This is failing inside a container

B

BigpodOP•7/28/23, 7:01 PM

could that be it

K

Kyle Gospo•7/28/23, 7:01 PM

Noticed this recently, can't setcap either

G

Gerblesh•7/28/23, 7:01 PM

It fails in a normal container too

G

Gerblesh•7/28/23, 7:02 PM

In a fedora container I mean

BBigpod possibly a limitation of overlayFS

A

akdev•7/28/23, 7:23 PM

Mm maybe but then it should work on bind mounts no?

A

akdev•7/28/23, 7:24 PM

Some research suggest overlayfs supports selinux

A

akdev•7/28/23, 7:26 PM

https://bugzilla.redhat.com/show_bug.cgi?id=1765243

G

Gerblesh•7/30/23, 3:00 AM

@akdev did you report the podman restorecon issue?

A

akdev•7/30/23, 3:01 AM

No, but I did identify why I was getting container_t - turns out that rootful podman sets the filesystem label for the underlying overlayfs

A

akdev•7/30/23, 3:03 AM

I’m not really sure what issue to file tbh, restorecon works on bind mounts

A

akdev•7/30/23, 3:03 AM

So it is related to overlayfs somehow

A

akdev•7/30/23, 3:10 AM

Mm I found:

label=nested: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without nested, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels.

A

akdev•7/30/23, 3:10 AM

This could be the solution

Aakdev Mm I found: > label=nested: Allows SELinux modifications within the container. ...

G

Gerblesh•7/30/23, 3:15 AM

Ah

G

Gerblesh•7/30/23, 3:15 AM

Do we want to try to fix the podman build action then?

A

akdev•7/30/23, 3:20 AM

I tried locally and it looks like it doesn't fix this

A

akdev•7/30/23, 3:43 AM

it's more complex than I thought:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-working_with_selinux-mounting_file_systems

To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the root user, use the mount -o context=SELinux_user:role:type:level command when mounting the required file system.

Newly-created files and directories on this file system appear to have the SELinux context specified with -o context. However, since these changes are not written to disk, the context specified with this option does not persist between mounts.

so:

podman sets context=container_t
this stops restorecon from working
no clue what that means for ostree

A

akdev•7/30/23, 3:45 AM

on another note I found out this super cool podman usage:

sudo podman run \
  --privileged \
  --rm -it \
  --security-opt label=disable \
  -v /sys/fs/selinux:/sys/fs/selinux \
  -v /etc/selinux/config:/etc/selinux/config:ro \
  --userns=host \
  -v "$HOME:$HOME" \
  --rootfs /:O \
  /bin/bash

sudo podman run \
  --privileged \
  --rm -it \
  --security-opt label=disable \
  -v /sys/fs/selinux:/sys/fs/selinux \
  -v /etc/selinux/config:/etc/selinux/config:ro \
  --userns=host \
  -v "$HOME:$HOME" \
  --rootfs /:O \
  /bin/bash

sudo podman run \
  --privileged \
  --rm -it \
  --security-opt label=disable \
  -v /sys/fs/selinux:/sys/fs/selinux \
  -v /etc/selinux/config:/etc/selinux/config:ro \
  --userns=host \
  -v "$HOME:$HOME" \
  --rootfs /:O \
  /bin/bash

sudo podman run \
  --privileged \
  --rm -it \
  --security-opt label=disable \
  -v /sys/fs/selinux:/sys/fs/selinux \
  -v /etc/selinux/config:/etc/selinux/config:ro \
  --userns=host \
  -v "$HOME:$HOME" \
  --rootfs /:O \
  /bin/bash

the

--rootfs /:O

--rootfs /:O

--rootfs /:O

--rootfs /:O mounts the rootfs from your current system into a temporary overlay(rw) then puts you inside that

Aakdev on another note I found out this super cool podman usage: ```bash sudo podman r...

G

Gerblesh•7/30/23, 4:06 AM

Is there any way to get around this or is it just an inherent limitation then?

G

Gerblesh•7/30/23, 4:07 AM

How does ostree/rpm-ostree handle it?

G

Gerblesh•7/30/23, 4:07 AM

Because they do have SELinux policies loaded by default

G

Gerblesh•7/30/23, 4:08 AM

Idk of those are from the OCI

G

Gerblesh•7/30/23, 4:09 AM

Might want to see if there's a way to define it in ostree?

A

akdev•7/30/23, 4:10 AM

what I am thinking that happens is that ostree is running restorecon on the deployment

G

Gerblesh•7/30/23, 4:12 AM

Hmmmm

G

Gerblesh•7/30/23, 4:12 AM

How do we define it in ostree?

G

Gerblesh•7/30/23, 4:13 AM

That's the question

A

akdev•7/30/23, 4:17 AM

looks like I was right about that, they relabel on deployment:

https://github.com/ostreedev/ostree/blob/a2663e8041ffadb764c71a055dd63dba4e7ff378/src/libostree/ostree-sysroot-deploy.c#L799

https://github.com/ostreedev/ostree/blob/a2663e8041ffadb764c71a055dd63dba4e7ff378/src/libostree/ostree-sysroot-deploy.c#L737C8-L737C34

https://github.com/ostreedev/ostree/blob/main/src/libostree/ostree-sepolicy.c#L593

A

akdev•7/30/23, 4:17 AM

mm I think

ostree_sepolicy_restorecon()

ostree_sepolicy_restorecon()

ostree_sepolicy_restorecon()

ostree_sepolicy_restorecon() might be buggy from ostree

A

akdev•7/30/23, 4:19 AM

according to this ostree is trying to follow the selinux policy

A

akdev•7/30/23, 4:20 AM

this is reimplementing

restorecon

restorecon

restorecon

restorecon

G

Gerblesh•7/30/23, 4:26 AM

So the issue was in the right place?

G

Gerblesh•7/30/23, 4:27 AM

rpm-ostree?

A

akdev•7/30/23, 4:28 AM

no, just plain ostree

G

Gerblesh•7/30/23, 4:29 AM

Ah

R

Robert•7/30/23, 10:04 AM

That could have been bad...

S

Sofie•7/30/23, 1:00 PM

https://media.discordapp.net/attachments/1074422586894712912/1135190591974682734/Screenshot_20230730_154148.png

S

Sofie•7/30/23, 1:00 PM

How do I fix this?

RRobert 😬 That could have been bad...

A

akdev•7/30/23, 1:01 PM

Didn’t it delete your homedir?

Aakdev Didn’t it delete your homedir?

R

Robert•7/30/23, 1:02 PM

Na. Luckily it wasn't my silverblue system

GGerblesh rpm-ostree?

A

akdev•7/30/23, 1:58 PM

ok I think i figured it out, ostree unpacks the tar file inside the container image and looks at the selinux policy inside

/usr/etc/selinux

/usr/etc/selinux

/usr/etc/selinux

/usr/etc/selinux based on this it will relabel the final system

greetd

greetd

greetd

greetd doesn't actually ship any policy (huh?) but rather they just label their files at build time and hope that the destination will keep those changes but

podman

podman

podman

podman basically destroys that information due to overlayfs

A

akdev•7/30/23, 2:00 PM

the workaround is to ship this file: https://src.fedoraproject.org/rpms/greetd/blob/rawhide/f/greetd.fc

in

/usr/etc/selinux/targeted/contexts/files/file_contexts.greetd

/usr/etc/selinux/targeted/contexts/files/file_contexts.greetd

/usr/etc/selinux/targeted/contexts/files/file_contexts.greetd

/usr/etc/selinux/targeted/contexts/files/file_contexts.greetd

A

akdev•7/30/23, 2:01 PM

this should make ostree pickup the correct label at deployment time

A

akdev•7/30/23, 2:08 PM

oh they actually ship the policy but it is in binary form

A

akdev•7/30/23, 2:21 PM

https://github.com/ostreedev/ostree-rs-ext/issues/510

A

akdev•7/30/23, 2:24 PM

now I know a lot about ostree I guess

T

tn•7/30/23, 5:18 PM

Does

rpm-ostree install

rpm-ostree install

have an equivalent to dnf's

--enablerepo

--enablerepo

--enablerepo

--enablerepo flag to specify which repo a package should come from? I'm trying to replace a single library with one from rawhide in a custom image.

T

tn•7/30/23, 5:19 PM

I could probably just grab the rpm file directly by url but I'd like to make sure it stays up to date

Ttn Does `rpm-ostree install` have an equivalent to dnf's `--enablerepo` flag to spe...

K

Kyle Gospo•7/30/23, 5:21 PM

install doesn't but replace does

K

Kyle Gospo•7/30/23, 5:21 PM

hold on

possibly a limitation of overlayFS

Similar Threads

Similar Threads

Similar Threads