Bug 2095528

OK so in this update we want to test the merged PRs to the rhel8 branch: https://github.com/coreos/rpm-ostree/pulls?q=is%3Apr+label%3Arhel8+is%3Aclosed

Which is basically

- https://github.com/coreos/rpm-ostree/pull/3749
- https://github.com/coreos/rpm-ostree/pull/3751

OK I tested this; it also needs https://github.com/openshift/os/pull/876

But basically, if you add this build in cosa, or craft a dockerfile that installs it (and librhsm), then along with the above fix (which you can also do manually in a container) then running the built rhcos container on a subscribed rhel8 host made `rpm-ostree install usbguard` work.

OK, we found out that the librhsm feature enablement was missing; this should be fixed by
 https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=46408122

> libsemanage.semanage_commit_sandbox: Error while renaming /etc/selinux/targeted/active to /etc/selinux/targeted/previous. (Invalid cross-device link).

This was fixed by https://github.com/SELinuxProject/selinux/commit/c7a3b93e31df312ed5b71436ec874054a95d4209
(See https://github.com/SELinuxProject/selinux/pull/342 )

It's not a change in rpm-ostree, but in libselinux I think.

So it's a great thing that the fix made it into current RHCOS!

(In reply to Colin Walters from comment #8)
> > libsemanage.semanage_commit_sandbox: Error while renaming /etc/selinux/targeted/active to /etc/selinux/targeted/previous. (Invalid cross-device link).
> 
> This was fixed by
> https://github.com/SELinuxProject/selinux/commit/
> c7a3b93e31df312ed5b71436ec874054a95d4209
> (See https://github.com/SELinuxProject/selinux/pull/342 )
> 
> It's not a change in rpm-ostree, but in libselinux I think.
> 
> So it's a great thing that the fix made it into current RHCOS!

Sorry, I meant not related to the bug as can not reproduce in latest RHCOS.

Thanks for your confirmation!

Verify passed with rpm-ostree-2022.2.8.gd50a74bd-2.el8.x86_64, build rhcos container (and include fixed rpm-ostree) with Dockerfile on a subscribed rhel8 host, run container and exec `rpm-ostree install usbguard` successfully


[test@hhei-rhel8 ~]$ podman build -t rhcos .

[test@hhei-rhel8 ~]$ podman run --rm --name rhcos -it localhost/rhcos:latest /bin/bash
bash-4.4# rpm -q librhsm rpm-ostree
librhsm-0.0.3-4.el8.x86_64
rpm-ostree-2022.2.8.gd50a74bd-2.el8.x86_64
bash-4.4# ls /etc/pki/entitlement-host
1020239473089209096-key.pem  1020239473089209096.pem
bash-4.4# ls /etc/rhsm-host
ca  logging.conf  rhsm.conf  syspurpose

bash-4.4# rpm-ostree install usbguard
Enabled rpm-md repositories: rhel-8-for-x86_64-baseos-rpms rhel-8-for-x86_64-appstream-rpms
Updating metadata for 'rhel-8-for-x86_64-baseos-rpms'... done
Updating metadata for 'rhel-8-for-x86_64-appstream-rpms'... done
Importing rpm-md... done
rpm-md repo 'rhel-8-for-x86_64-baseos-rpms'; generated: 2022-06-30T20:05:32Z solvables: 12609
rpm-md repo 'rhel-8-for-x86_64-appstream-rpms'; generated: 2022-07-06T14:05:13Z solvables: 27858
Resolving dependencies... done
Will download: 4 packages (1.6 MB)
Downloading from 'rhel-8-for-x86_64-appstream-rpms'... done
Downloading from 'rhel-8-for-x86_64-baseos-rpms'... done
Installing: usbguard-selinux-1.0.0-8.el8.noarch (rhel-8-for-x86_64-appstream-rpms)
libsemanage.semanage_commit_sandbox: Error while renaming /etc/selinux/targeted/active to /etc/selinux/targeted/previous. (Invalid cross-device link).
/usr/sbin/semodule:  Failed!
Installing: protobuf-3.5.0-13.el8.x86_64 (rhel-8-for-x86_64-appstream-rpms)
Installing: libqb-1.0.3-12.el8.x86_64 (rhel-8-for-x86_64-baseos-rpms)
Installing: usbguard-1.0.0-8.el8.x86_64 (rhel-8-for-x86_64-appstream-rpms)
bash-4.4# rpm -q usbguard
usbguard-1.0.0-8.el8.x86_64

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (rpm-ostree bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7612