I suspect the problem is this last line ` --security-opt=label=level:s0-s0:c0.c1023 ` but I don't

I suspect the problem is this last line

    --security-opt=label=level:s0-s0:c0.c1023

    --security-opt=label=level:s0-s0:c0.c1023

    --security-opt=label=level:s0-s0:c0.c1023

    --security-opt=label=level:s0-s0:c0.c1023

but I don't even know what any of that means.

bketelsenOP•8/3/23, 2:06 PM

Any expert help would be appreciated, and of course upstreamed into bluefin

akdev•8/3/23, 2:15 PM

Have you tried label=disable

bketelsenOP•8/3/23, 2:22 PM

that doesn't fail.

bketelsenOP•8/3/23, 2:23 PM

i'm assuming it also doesn't allow nested confined containers

bketelsenOP•8/3/23, 2:26 PM

I can't figure out how to give the user sudo access inside the container

EyeCantCU•8/3/23, 2:33 PM

This is why Nvidia 37 is failing. Asus Linux Copr dropped 37

https://copr.fedorainfracloud.org/coprs/lukenukem/asus-linux/

j0rge•8/3/23, 2:34 PM

what's in there that we use?

j0rge•8/3/23, 2:35 PM

oh, that thing, sorry I'm on mobile

j0rge•8/3/23, 2:35 PM

can we skip that build just for 37?

EyeCantCU•8/3/23, 2:36 PM

I think just supergfxctl

EyeCantCU•8/3/23, 2:36 PM

We can skip it

EyeCantCU•8/3/23, 2:36 PM

Or I can rebuild it and add 37 back

j0rge•8/3/23, 2:38 PM

I don't know how the nvidia repo works, was hoping we had sections in in main's packages.json

j0rge•8/3/23, 2:38 PM

so we could exclude it for 37

j0rge•8/3/23, 2:38 PM

but whatever works, it's been three days so whatever gets them green so it unblocks you for bazzite

EyeCantCU•8/3/23, 2:39 PM

We don't have that. These packages get installed via install.sh by invoking rpm-ostree

j0rge•8/3/23, 2:39 PM

ah ok

Jj0rge but whatever works, it's been three days so whatever gets them green so it unblo...

EyeCantCU•8/3/23, 2:40 PM

In that case, can I get a supergfxctl project created on Copr? I'll build supergfxctl, the plasmoid, and GNOME shell extension out of that

j0rge•8/3/23, 2:40 PM

yeah that's probably the best long term plan

EyeCantCU•8/3/23, 2:40 PM

Awesome. Thank you!

j0rge•8/3/23, 2:40 PM

"do the kyle"

EyeCantCU•8/3/23, 2:40 PM

Lol

j0rge•8/3/23, 2:41 PM

I'm done with my sabbatical and my job will have me on the road a ton, you don't need my permission to fix anything, Just Do It(tm).

j0rge•8/3/23, 2:41 PM

Someone was sitting next to me and saw my framework with bluefin and was like "what is that?!?!?!"

AdamIsrael•8/3/23, 2:42 PM

EyeCantCU•8/3/23, 2:42 PM

I really want to get a 16

j0rge•8/3/23, 2:42 PM

yeah then I fired up a cluster and everyone was like "what?!"

jerb•8/3/23, 2:42 PM

me too, i just can't justify it right now

bketelsenOP•8/3/23, 2:50 PM

I wonder if I need to do the podman-system-generator dance?

bketelsenOP•8/3/23, 2:50 PM

this issue mentions it

bketelsenOP•8/3/23, 2:50 PM

https://github.com/containers/podman/issues/18979

GitHub

quadlet generator is not able to correctly parse lines with trainli...

Issue Description I copypasted .container file from podmansh man page but the way I did it, it added some trailing whitespaces and lines containing only whitespaces: [Unit] Description=The podmansh...

Bbketelsen I suspect the problem is this last line ` --security-opt=label=level:s0-s0:c0...

akdev•8/3/23, 3:00 PM

This is setting the last component of the selinux label which corresponds to the "level" - this is technically only relevant on systems with multi-level security

Bbketelsen i'm assuming it also doesn't allow nested confined containers

akdev•8/3/23, 3:00 PM

For nested containers you're supposed to be able to do

label=nested

label=nested

I am not sure why they're manually setting the context to container_t

akdev•8/3/23, 3:01 PM

You also need a recent podman version for this to work. I'm currently semi-engaged with upstream troubleshooting some selinux issues in ublue

akdev•8/3/23, 3:02 PM

The main issue is that podman mounts the rootfs layer with a

context=

context=

flag and this causes the selinux operations to fail because the selinux context is hardcoded by podman and can't be modified in the overlayfs layer

akdev•8/3/23, 3:04 PM

label=nested changes this behavior so that the overlayfs will be mounted with

rootcontext=

rootcontext=

instead which only sets the selinux context of the rootfs inode

akdev•8/3/23, 3:05 PM

but on top of this you still need:

-v /etc/selinux:/etc/selinux
--privileged
--security-opt=unmask=/sys/fs/selinux

akdev•8/3/23, 3:06 PM

Because afaict label=nested doesn't mount the necessary files for libselinux to work

Bbketelsen I can't figure out how to give the user sudo access inside the container

akdev•8/3/23, 3:07 PM

mm maybe run with

--privileged

--privileged

if you want this

Also if you want "real root" then label=disable should work

akdev•8/3/23, 3:08 PM

but selinux relabeling will only work in bind mounts

akdev•8/3/23, 3:08 PM

not inside the container rootfs because of the

context=

context=

stuff above

bketelsenOP•8/3/23, 3:19 PM

i'm going to try with a completely different image and see what differences there are

akdev•8/3/23, 3:44 PM

I got pointed to this discussion by cgwalters earlier today: https://github.com/containers/storage/pull/1608

As it stands podman OCI selinux handling is kind of flaky

GitHub

Ignore security.ima xattrs by rhatdan · Pull Request #1608 · contai...

Fixes: containers/podman#18543

akdev•8/3/23, 3:45 PM

The root cause is that selinux is not namespaced so semantically containers and selinux will not really play along that well

bketelsenOP•8/3/23, 4:07 PM

I got pretty far with this this quadlet:

bketelsenOP•8/3/23, 4:07 PM

bash-5.2# cat podmansh.container
[Unit]
Description=The podmansh container
After=local-fs.target
ExecStartPre=-/bin/mkdir -p %h/data

[Container]
Image=quay.io/toolbx-images/ubuntu-toolbox:latest
ContainerName=podmansh
RemapUsers=keep-id
PodmanArgs=--security-opt=unmask=/sys/fs/selinux \
    --privileged
RunInit=yes
Volume=%h/data:%h:Z
Volume=/etc/selinux:/etc/selinux
WorkingDir=%h
Exec=sleep infinity
Network=host

[Service]
ExecStartPre=/usr/bin/mkdir -p %h/data
TimeoutStartSec=900

[Install]
RequiredBy=default.target

bash-5.2# cat podmansh.container
[Unit]
Description=The podmansh container
After=local-fs.target
ExecStartPre=-/bin/mkdir -p %h/data

[Container]
Image=quay.io/toolbx-images/ubuntu-toolbox:latest
ContainerName=podmansh
RemapUsers=keep-id
PodmanArgs=--security-opt=unmask=/sys/fs/selinux \
    --privileged
RunInit=yes
Volume=%h/data:%h:Z
Volume=/etc/selinux:/etc/selinux
WorkingDir=%h
Exec=sleep infinity
Network=host

[Service]
ExecStartPre=/usr/bin/mkdir -p %h/data
TimeoutStartSec=900

[Install]
RequiredBy=default.target

bketelsenOP•8/3/23, 4:24 PM

biggest showstopper right now is that I can't use sudo for anything. it prompts for password, never accepts the password, so I can't investigate the container

bketelsenOP•8/3/23, 4:26 PM

the whole thing is fascinating, there's a lot of moving parts here

akdev•8/3/23, 4:27 PM

you can use podman exec -u 0 to investigate

Bbketelsen biggest showstopper right now is that I can't use sudo for anything. it prompts ...

akdev•8/3/23, 4:29 PM

Mm this is not a rootful container is it?

bash-5.2# cat podmansh.container [Unit] Description=The podmansh container After=local-fs.target ExecStartPre=-/bin/mkdir -p %h/data [Container] Image=quay.io/toolbx-images/ubuntu-toolbox:latest ContainerName=podmansh RemapUsers=keep-id PodmanArgs=--security-opt=unmask=/sys/fs/selinux \ --privileged RunInit=yes Volume=%h/data:%h:Z Volume=/etc/selinux:/etc/selinux WorkingDir=%h Exec=sleep infinity Network=host [Service] ExecStartPre=/usr/bin/mkdir -p %h/data TimeoutStartSec=900 [Install] RequiredBy=default.target

I suspect the problem is this last line ` --security-opt=label=level:s0-s0:c0.c1023 ` but I don't

Similar Threads

Similar Threads

Similar Threads