Bug 2071206
| Summary: | Binary policy creation failed at /var/lib/selinux/targeted/tmp/modules/200/container/cil:1786 | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Knut J BJuland <knutjbj> |
| Component: | osbuild | Assignee: | Ondřej Budai <obudai> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 36 | CC: | akoutsou, ckellner, dwalsh, fzdarsky, grepl.miroslav, lemonzest, lueberni, lvrabec, mmalik, obudai, omosnace, osbuilders, pkoncity, ssteinbe, tgunders, tlavocat, user-cont-team+packit-fas, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | osbuild-54-2.fc35 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-04-26 07:30:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2056303 | ||
|
Description
Knut J BJuland
2022-04-02 07:20:08 UTC
Knut, Can you list all installed custom modules? # semodule -lfull | grep -v ^100 # rpm -qa "*-selinux" Did you make some customizations to the SELinux policy? https://bugzilla.redhat.com/show_bug.cgi?id=2071939 Same issue I'm having here [ 9.756776] SELinux: Context system_u:object_r:container_unit_file_t:s0 is not valid (left unmapped). [ 33.125507] SELinux: Context system_u:object_r:container_var_lib_t:s0 is not valid (left unmapped). [ 33.213093] SELinux: Context system_u:object_r:container_runtime_exec_t:s0 is not valid (left unmapped). [ 33.439133] SELinux: Context system_u:object_r:tabrmd_exec_t:s0 is not valid (left unmapped). [ 161.776462] SELinux: Context system_u:object_r:flatpak_helper_exec_t:s0 is not valid (left unmapped). [ 161.945236] SELinux: Context system_u:object_r:vnc_session_exec_t:s0 is not valid (left unmapped). [ 194.716357] SELinux: Context system_u:object_r:container_log_t:s0 is not valid (left unmapped). [ 287.313712] SELinux: Context unconfined_u:object_r:vnc_home_t:s0 is not valid (left unmapped). [ 1518.845746] SELinux: Context system_u:object_r:conmon_exec_t:s0 is not valid (left unmapped). [ 1518.849016] SELinux: Context system_u:object_r:swtpm_exec_t:s0 is not valid (left unmapped). [ 1518.850845] SELinux: Context system_u:object_r:osbuild_exec_t:s0 is not valid (left unmapped). [ 1584.971276] SELinux: Context system_u:object_r:container_config_t:s0 is not valid (left unmapped). I removed podman. When I reinstalled I got this error. Running scriptlet: container-selinux-2:2.181.0-2.fc36.noarch 1/15 libsepol.context_from_record: type insights_client_var_lib_t is not defined libsepol.context_from_record: could not create context structure libsepol.context_from_string: could not create context structure libsepol.sepol_context_to_sid: could not convert system_u:object_r:insights_client_var_lib_t:s0 to sid invalid context system_u:object_r:insights_client_var_lib_t:s0 Failed to commit changes to booleans: Success Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/osbuild/cil:127 Failed to resolve AST /usr/sbin/semodule: Failed! Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/container/cil:1265 Failed to resolve AST semodule: Failed! Hi osbuild folks, Every custom selinux module using directly or indirectly socket_class_set need to be rebuilt with selinux-policy-35.17-1.fc35 https://bodhi.fedoraproject.org/updates/FEDORA-2022-c5bee6b70f selinux-policy-34.27-1.fc34 https://bodhi.fedoraproject.org/updates/FEDORA-2022-eaef082697 to ensure these classes are not in use: - bridge_socket - ib_socket - mpls_socket Please do so before F36 GA. Hello Zdeněk, happy to do it but it firstly needs to be in buildroot, right? We did fresh builds today actually but they picked the old version, see: - https://koji.fedoraproject.org/koji/rpminfo?rpmID=30078551 - https://koji.fedoraproject.org/koji/rpminfo?rpmID=30078533 Is buildroot override fine for selinux-policy, or do we have to wait until the selinux-policy updates reach stable? What do you prefer? Thanks, Ondřej sudo semodule -lfull | grep -v ^100 400 pcpupstream pp 400 pcpupstream-container pp 200 cockpit pp 200 container pp 200 flatpak pp 200 ipa pp 200 mysql pp 200 osbuild pp 200 smartmon pp 200 snappy pp 200 swtpm pp 200 swtpm_svirt pp rpm -qa "*-selinux" dnfdaemon-selinux-0.3.20-8.fc36.noarch rpm-plugin-selinux-4.17.0-10.fc36.x86_64 freeipa-selinux-4.9.8-3.fc36.noarch mysql-selinux-1.0.4-4.fc36.noarch pcp-selinux-5.3.7-1.fc36.x86_64 smartmontools-selinux-7.3-2.fc36.noarch snapd-selinux-2.55.3-1.fc36.noarch cockpit-selinux-267-1.fc36.noarch osbuild-selinux-54-1.fc36.noarch flatpak-selinux-1.12.7-2.fc36.noarch Selinux have been modify by nvidia packages from rpmfusion. (In reply to Ondřej Budai from comment #6) > Hello Zdeněk, > > happy to do it but it firstly needs to be in buildroot, right? We did fresh > builds today actually but they picked the old version, see: > > - https://koji.fedoraproject.org/koji/rpminfo?rpmID=30078551 > - https://koji.fedoraproject.org/koji/rpminfo?rpmID=30078533 Hello Ondřej, I can't see it in the output, but I suppose you are right, both selinux-policy updates are awaiting karma based on community testing. The F35 build is expected be okay as there are only a few changes after the previous build. > Is buildroot override fine for selinux-policy, or do we have to wait until > the selinux-policy updates reach stable? What do you prefer? We need to find a balance between having it tested enough and reaching F36 before GA. At this moment I'm closer to the buildroot override. FEDORA-2022-c5bee6b70f has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2022-c5bee6b70f FEDORA-2022-c5bee6b70f has been pushed to the Fedora 35 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-c5bee6b70f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-c5bee6b70f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2022-c5bee6b70f has been pushed to the Fedora 35 stable repository. If problem still persists, please make note of it in this bug report. |