Description of problem: 16.1 undercloud deployment failed. $ podman ps -a |grep Exited | grep -v '(0)' ac2d7c87dc72 undercloud-0.ctlplane.redhat.local:8787/rh-osbs/rhosp16-openstack-nova-compute-ironic:16.1_20200401.1 /container-config... About an hour ago Exited (1) About an hour ago nova_statedir_owner Probably relevant output line: "ERROR:nova_statedir:Could not set selinux context of /var/lib/nova to system_u:object_r:container_file_t:s0:" Version-Release number of selected component (if applicable): rpm -qa |grep triple openstack-tripleo-puppet-elements-11.2.2-0.20200311084936.a6fef08.el8ost.noarch python3-tripleoclient-12.3.2-0.20200331233427.9a5892e.el8ost.noarch python3-tripleo-common-11.3.3-0.20200331083848.ace00a3.el8ost.noarch openstack-tripleo-common-11.3.3-0.20200331083848.ace00a3.el8ost.noarch openstack-tripleo-image-elements-10.6.2-0.20200313223428.8c91b46.el8ost.noarch openstack-tripleo-validations-11.3.2-0.20200318113434.3fd14c9.el8ost.noarch tripleo-ansible-0.4.2-0.20200330173442.a55eb2a.el8ost.noarch python3-tripleoclient-heat-installer-12.3.2-0.20200331233427.9a5892e.el8ost.noarch openstack-tripleo-common-containers-11.3.3-0.20200331083848.ace00a3.el8ost.noarch puppet-tripleo-11.4.1-0.20200401053434.33288b0.el8ost.noarch ansible-tripleo-ipsec-9.2.1-0.20200311073016.0c8693c.el8ost.noarch openstack-tripleo-heat-templates-11.3.2-0.20200401083149.cd5c992.el8ost.noarch ansible-role-tripleo-modify-image-1.1.1-0.20200311081746.bb6f78d.el8ost.noarch How reproducible: always
audit2why -ve < /var/log/audit/audit.log type=AVC msg=audit(1585817973.732:1973): avc: denied { relabelfrom } for pid=38851 comm="python3" name="nova" dev="vda1" ino=33580128 scontext=system_u:system_r:container_t:s0:c738,c1014 tcontext=unconfined_u:object_r:container_file_t:s0 tclass=dir permissive=0 Was caused by: #Constraint rule: # constrain dir { create relabelfrom relabelto } ((u1 == u2 -Fail-) or (t1 == can_change_object_identity -Fail-) ); Constraint DENIED # Possible cause is the source user (system_u) and target user (unconfined_u) are different. # Possible cause is the source level (s0:c738,c1014) and target level (s0) are different.
Similar to https://github.com/containers/libpod/issues/3683. Running this container with --security-opt label=disable resolves the issue
Undercloud stage is passing: https://rhos-qe-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/job/phase1-16.1_director-rhel-8.2-virthost-1cont_1comp_1ceph-ipv4-geneve-ceph/
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:3148