i'm assuming it also doesn't allow nested confined containers

B

bketelsenOP•8/3/23, 2:26 PM

I can't figure out how to give the user sudo access inside the container

E

EyeCantCU•8/3/23, 2:33 PM

This is why Nvidia 37 is failing. Asus Linux Copr dropped 37

https://copr.fedorainfracloud.org/coprs/lukenukem/asus-linux/

J

j0rge•8/3/23, 2:34 PM

what's in there that we use?

J

j0rge•8/3/23, 2:35 PM

oh, that thing, sorry I'm on mobile

J

j0rge•8/3/23, 2:35 PM

can we skip that build just for 37?

E

EyeCantCU•8/3/23, 2:36 PM

I think just supergfxctl

E

EyeCantCU•8/3/23, 2:36 PM

We can skip it

E

EyeCantCU•8/3/23, 2:36 PM

Or I can rebuild it and add 37 back

J

j0rge•8/3/23, 2:38 PM

I don't know how the nvidia repo works, was hoping we had sections in in main's packages.json

J

j0rge•8/3/23, 2:38 PM

so we could exclude it for 37

J

j0rge•8/3/23, 2:38 PM

but whatever works, it's been three days so whatever gets them green so it unblocks you for bazzite

E

EyeCantCU•8/3/23, 2:39 PM

We don't have that. These packages get installed via install.sh by invoking rpm-ostree

J

j0rge•8/3/23, 2:39 PM

ah ok

Jj0rge but whatever works, it's been three days so whatever gets them green so it unblo...

E

EyeCantCU•8/3/23, 2:40 PM

In that case, can I get a supergfxctl project created on Copr? I'll build supergfxctl, the plasmoid, and GNOME shell extension out of that

J

j0rge•8/3/23, 2:40 PM

yeah that's probably the best long term plan

E

EyeCantCU•8/3/23, 2:40 PM

Awesome. Thank you!

J

j0rge•8/3/23, 2:40 PM

"do the kyle"

E

EyeCantCU•8/3/23, 2:40 PM

Lol

J

j0rge•8/3/23, 2:41 PM

I'm done with my sabbatical and my job will have me on the road a ton, you don't need my permission to fix anything, Just Do It(tm).

J

j0rge•8/3/23, 2:41 PM

Someone was sitting next to me and saw my framework with bluefin and was like "what is that?!?!?!"

A

AdamIsrael•8/3/23, 2:42 PM

E

EyeCantCU•8/3/23, 2:42 PM

I really want to get a 16

J

j0rge•8/3/23, 2:42 PM

yeah then I fired up a cluster and everyone was like "what?!"

J

jerb•8/3/23, 2:42 PM

me too, i just can't justify it right now

B

bketelsenOP•8/3/23, 2:50 PM

I wonder if I need to do the podman-system-generator dance?

B

bketelsenOP•8/3/23, 2:50 PM

this issue mentions it

B

bketelsenOP•8/3/23, 2:50 PM

https://github.com/containers/podman/issues/18979

GitHub

quadlet generator is not able to correctly parse lines with trainli...

Issue Description I copypasted .container file from podmansh man page but the way I did it, it added some trailing whitespaces and lines containing only whitespaces: [Unit] Description=The podmansh...

Bbketelsen I suspect the problem is this last line ` --security-opt=label=level:s0-s0:c0...

A

akdev•8/3/23, 3:00 PM

This is setting the last component of the selinux label which corresponds to the "level" - this is technically only relevant on systems with multi-level security

Bbketelsen i'm assuming it also doesn't allow nested confined containers

A

akdev•8/3/23, 3:00 PM

For nested containers you're supposed to be able to do

label=nested

label=nested

label=nested

label=nested

I am not sure why they're manually setting the context to container_t

A

akdev•8/3/23, 3:01 PM

You also need a recent podman version for this to work. I'm currently semi-engaged with upstream troubleshooting some selinux issues in ublue

A

akdev•8/3/23, 3:02 PM

The main issue is that podman mounts the rootfs layer with a

context=

context=

context=

context= flag and this causes the selinux operations to fail because the selinux context is hardcoded by podman and can't be modified in the overlayfs layer

A

akdev•8/3/23, 3:04 PM

label=nested changes this behavior so that the overlayfs will be mounted with

rootcontext=

rootcontext=

rootcontext=

rootcontext= instead which only sets the selinux context of the rootfs inode

A

akdev•8/3/23, 3:05 PM

but on top of this you still need:

-v /etc/selinux:/etc/selinux
--privileged
--security-opt=unmask=/sys/fs/selinux

A

akdev•8/3/23, 3:06 PM

Because afaict label=nested doesn't mount the necessary files for libselinux to work

Bbketelsen I can't figure out how to give the user sudo access inside the container

A

akdev•8/3/23, 3:07 PM

mm maybe run with

--privileged

--privileged

--privileged

--privileged if you want this

Also if you want "real root" then label=disable should work

A

akdev•8/3/23, 3:08 PM

but selinux relabeling will only work in bind mounts

A

akdev•8/3/23, 3:08 PM

not inside the container rootfs because of the

context=

context=

context=

context= stuff above

B

bketelsenOP•8/3/23, 3:19 PM

i'm going to try with a completely different image and see what differences there are

A

akdev•8/3/23, 3:44 PM

I got pointed to this discussion by cgwalters earlier today: https://github.com/containers/storage/pull/1608

As it stands podman OCI selinux handling is kind of flaky

GitHub

Ignore security.ima xattrs by rhatdan · Pull Request #1608 · contai...

Fixes: containers/podman#18543

A

akdev•8/3/23, 3:45 PM

The root cause is that selinux is not namespaced so semantically containers and selinux will not really play along that well

B

bketelsenOP•8/3/23, 4:07 PM

I got pretty far with this this quadlet:

B

bketelsenOP•8/3/23, 4:07 PM

bash-5.2# cat podmansh.container
[Unit]
Description=The podmansh container
After=local-fs.target
ExecStartPre=-/bin/mkdir -p %h/data

[Container]
Image=quay.io/toolbx-images/ubuntu-toolbox:latest
ContainerName=podmansh
RemapUsers=keep-id
PodmanArgs=--security-opt=unmask=/sys/fs/selinux \
    --privileged
RunInit=yes
Volume=%h/data:%h:Z
Volume=/etc/selinux:/etc/selinux
WorkingDir=%h
Exec=sleep infinity
Network=host

[Service]
ExecStartPre=/usr/bin/mkdir -p %h/data
TimeoutStartSec=900

[Install]
RequiredBy=default.target

bash-5.2# cat podmansh.container
[Unit]
Description=The podmansh container
After=local-fs.target
ExecStartPre=-/bin/mkdir -p %h/data

[Container]
Image=quay.io/toolbx-images/ubuntu-toolbox:latest
ContainerName=podmansh
RemapUsers=keep-id
PodmanArgs=--security-opt=unmask=/sys/fs/selinux \
    --privileged
RunInit=yes
Volume=%h/data:%h:Z
Volume=/etc/selinux:/etc/selinux
WorkingDir=%h
Exec=sleep infinity
Network=host

[Service]
ExecStartPre=/usr/bin/mkdir -p %h/data
TimeoutStartSec=900

[Install]
RequiredBy=default.target

bash-5.2# cat podmansh.container
[Unit]
Description=The podmansh container
After=local-fs.target
ExecStartPre=-/bin/mkdir -p %h/data

[Container]
Image=quay.io/toolbx-images/ubuntu-toolbox:latest
ContainerName=podmansh
RemapUsers=keep-id
PodmanArgs=--security-opt=unmask=/sys/fs/selinux \
    --privileged
RunInit=yes
Volume=%h/data:%h:Z
Volume=/etc/selinux:/etc/selinux
WorkingDir=%h
Exec=sleep infinity
Network=host

[Service]
ExecStartPre=/usr/bin/mkdir -p %h/data
TimeoutStartSec=900

[Install]
RequiredBy=default.target

bash-5.2# cat podmansh.container
[Unit]
Description=The podmansh container
After=local-fs.target
ExecStartPre=-/bin/mkdir -p %h/data

[Container]
Image=quay.io/toolbx-images/ubuntu-toolbox:latest
ContainerName=podmansh
RemapUsers=keep-id
PodmanArgs=--security-opt=unmask=/sys/fs/selinux \
    --privileged
RunInit=yes
Volume=%h/data:%h:Z
Volume=/etc/selinux:/etc/selinux
WorkingDir=%h
Exec=sleep infinity
Network=host

[Service]
ExecStartPre=/usr/bin/mkdir -p %h/data
TimeoutStartSec=900

[Install]
RequiredBy=default.target

B

bketelsenOP•8/3/23, 4:24 PM

biggest showstopper right now is that I can't use sudo for anything. it prompts for password, never accepts the password, so I can't investigate the container

B

bketelsenOP•8/3/23, 4:26 PM

the whole thing is fascinating, there's a lot of moving parts here

A

akdev•8/3/23, 4:27 PM

you can use podman exec -u 0 to investigate

Bbketelsen biggest showstopper right now is that I can't use sudo for anything. it prompts ...

A

akdev•8/3/23, 4:29 PM

Mm this is not a rootful container is it?

B

bketelsenOP•8/3/23, 4:29 PM

no, I don't think so

A

akdev•8/3/23, 4:30 PM

Is it trying to read /etc off the host or the container? (Sorry not familiar with podman sh)

B

bketelsenOP•8/3/23, 4:30 PM

I think it's trying to read /etc from the container, I suspect it's not mounted but should be

B

bketelsenOP•8/3/23, 4:31 PM

at least /etc/shadow should be?

i'm assuming it also doesn't allow nested confined containers

Similar Threads

Similar Threads

Similar Threads