-
Story
-
Resolution: Done
-
Normal
-
None
-
openshift-4.12
-
None
-
False
-
None
-
False
-
0
-
0
We saw this in an OKD job:
https://github.com/openshift/machine-config-operator/pull/3358#issuecomment-1267532305
It's simple to reproduce, from say a current RHCOS 4.12 doing:
[root@cosa-devsh ~]# podman run --privileged --pid=host --net=host --rm -v /:/run/host quay.io/fedora/fedora-coreos:testing-devel "rpm-ostree" "ex" "deploy-from-self" "/run/host" NOTICE: Experimental commands are subject to change. error: Writing content object: Setting xattrs: fsetxattr(security.selinux): Invalid argument
I've tried doing `--security-opt label=type:unconfined_t` which gives the same error (of course), but using `install_t` I get:
[root@cosa-devsh ~]# podman run --privileged --security-opt label=type:install_t --pid=host --net=host --rm -v /:/run/host quay.io/fedora/fedora-coreos:testing-devel "rpm-ostree" "ex" "deploy-from-self" "/run/host" exec /usr/bin/rpm-ostree: permission denied [root@cosa-devsh ~]#
I'm really tempted to just `setenforce 0` for the first OS update...
