Uploaded image for project: 'Machine Config Operator'
  1. Machine Config Operator
  2. MCO-396

firstboot update does not handle major SELinux policy changes

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Done
    • Icon: Normal Normal
    • None
    • openshift-4.12
    • None
    • False
    • None
    • False
    • 0

      We saw this in an OKD job:

      https://github.com/openshift/machine-config-operator/pull/3358#issuecomment-1267532305

       

      It's simple to reproduce, from say a current RHCOS 4.12 doing:

       

      [root@cosa-devsh ~]# podman run --privileged --pid=host --net=host --rm -v /:/run/host quay.io/fedora/fedora-coreos:testing-devel "rpm-ostree" "ex" "deploy-from-self" "/run/host"
NOTICE: Experimental commands are subject to change.
error: Writing content object: Setting xattrs: fsetxattr(security.selinux): Invalid argument

       

      I've tried doing `--security-opt label=type:unconfined_t` which gives the same error (of course), but using `install_t` I get:

       

      [root@cosa-devsh ~]# podman run --privileged --security-opt label=type:install_t --pid=host --net=host --rm -v /:/run/host quay.io/fedora/fedora-coreos:testing-devel "rpm-ostree" "ex" "deploy-from-self" "/run/host"
exec /usr/bin/rpm-ostree: permission denied
[root@cosa-devsh ~]#

       

      I'm really tempted to just `setenforce 0` for the first OS update...

            [MCO-396] firstboot update does not handle major SELinux policy changes

            Brenton Leanhardt added a comment -

            Hi walters@redhat.com, Is this task still a priority Blocker for the MCO team?  If so, I think moving it to a bug and setting Release Blocker: Approved would be the best way for it to get the visibility it needs.  I'm happy to make the necessary changes if you like.

            Brenton Leanhardt added a comment - Hi walters@redhat.com , Is this task still a priority Blocker for the MCO team?  If so, I think moving it to a bug and setting Release Blocker: Approved would be the best way for it to get the visibility it needs.  I'm happy to make the necessary changes if you like.

            Colin Walters added a comment -

            https://github.com/openshift/machine-config-operator/pull/3358#issuecomment-1267565131

            Colin Walters added a comment - https://github.com/openshift/machine-config-operator/pull/3358#issuecomment-1267565131

            Colin Walters added a comment -

            Previously https://bugzilla.redhat.com/show_bug.cgi?id=1839065

            Colin Walters added a comment - Previously https://bugzilla.redhat.com/show_bug.cgi?id=1839065

              walters@redhat.com Colin Walters
              walters@redhat.com Colin Walters
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: