Comments (12)
A workaround is sudo mv /usr/lib64/rpm-plugins/selinux.so /usr/lib64/rpm-plugins/selinux.so.old
from toolbox.
Additional, value-add failure:
Traceback (most recent call last):
File "/usr/sbin/semanage", line 28, in <module>
import seobject
File "/usr/lib/python3.7/site-packages/seobject.py", line 34, in <module>
import sepolicy
File "/usr/lib/python3.7/site-packages/sepolicy/__init__.py", line 188, in <module>
raise e
File "/usr/lib/python3.7/site-packages/sepolicy/__init__.py", line 184, in <module>
policy_file = get_installed_policy()
File "/usr/lib/python3.7/site-packages/sepolicy/__init__.py", line 139, in get_installed_policy
raise ValueError(_("No SELinux Policy installed"))
ValueError: No SELinux Policy installed
Running scriptlet: tpm2-abrmd-selinux-2.0.0-2.fc29.noarch 267/315
cp: cannot stat '/etc/selinux/targeted/contexts/files/file_contexts': No such file or directory
error: %prein(tpm2-abrmd-selinux-2.0.0-2.fc29.noarch) scriptlet failed, exit status 1
Error in PREIN scriptlet in rpm package tpm2-abrmd-selinux
from toolbox.
does your rpm work if you install selinux-policy-targeted
inside the container? you will see a permission denied error when you install that rpm, but imho this can be ignored (seems like the package tries to load the policies which obviously does not work inside the container).
from toolbox.
Thanks for digging that up, @tosmi !
from toolbox.
The toolbox containers are created with --security-opt label=disable
, which turns off SELinux labelling. I wonder if removing that can help.
Labelling was turned off because some time ago, it would make container creation (or was it something else? I can't remember) really slow. However, I took that option out to enable labelling, and it didn't seem noticeably slow. Maybe Podman got better at this?
from toolbox.
@debarshiray The issue is /sys/fs/selinux is being mounted into the container. We saw this yesterday.
This is causing SELinux labeling to be turned on IFF, you have selinux-policy installed in an image, and running with --net=host.
podman run IMAGE id -Z
Should tell you SELinux is disabled.
But if you run
podman run --net=host IMAGE id -Z
It tells you the SELinux label.
This means tools inside the container like RPM attempt to do labeling. Which is the wrong thing to do. Whether or not SELinux separation is enabled.
from toolbox.
containers/podman#2613 fixes this problem.
from toolbox.
@mheon we might want to consider a new release of podman for this issue.
from toolbox.
@rhatdan I'd like to wait a week for things to settle a bit more, and for Brent to do more work on healthchecks. Once he lands his healthchecks v3 PR, I think we're good for a 1.2 release
from toolbox.
Thanks for the explanation and the fix, @rhatdan
I realized that I didn't have selinux-policy
in my toolboxes, which is why I wasn't able to reproduce this. @hughsie probably managed to pull it in as a side-effect of something else.
from toolbox.
probably managed to pull it in as a side-effect of something else
Indeed I did.
from toolbox.
Ok, great! Thanks everybody. Closing.
from toolbox.
Related Issues (20)
- List supported toolbox images
- Cannot access mounted drive with fuse outside of toolbox
- Xwayland broken in toolbox containers HOT 1
- Add distribution: Ubuntu 24.04 LTS HOT 2
- can't start ubuntu (useradd: UID is not unique) HOT 1
- systemd (255.6-1) breaks dependency
- Missing locales on Arch Linux guest HOT 3
- Can't resolve host `toolbox` inside `fedora-toolbox:40` container HOT 4
- Isolate $HOME directory via snapshot and overlay
- Can't enter fedora 40 toolbx: Failed to bind /etc/machine-id HOT 24
- run0 Allows execution on HOT 6
- Gstreamer unable to find plugins in toolbox
- Fish Shell Completions
- toolbox can't source path HOT 2
- Unable to run fzf through flatpak-spawn
- Fedora 39 Image doesn't build
- profile.d/toolbox.sh doesn't take into account TERMINFO_DIRS HOT 3
- Cannot get terminal window size inside toolbox via TIOCGWINSZ ioctl
- Hostname changing causes unexpected issues. HOT 3
- Visual bugs on my bash shell inside toolbox.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from toolbox.