Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: 1. Open a terminal 2. Clone the Delta Chat Android client source code from https://github.com/deltachat/deltachat-android 3. Change the directory to the cloned source code 4. Build the image using the following command: ` podman build --build-arg UID=$(id -u) --build-arg GID=$(id -g) . -t deltachat-android ` 5. Run the image using the following command: ` podman run --userns=keep-id -it --name deltachat -v $(pwd):/home/app -w /home/app localhost/deltachat-android ` 6. Within the container, install the toolchain: ` scripts/install-toolchains.sh ` 7. Notice that you get the error message "bash: scripts/install-toolchains.sh: Permission denied". 8. Notice that you get a notification from the SELinux Alert Browser. You can exit the container with by typing `exit`. SELinux is preventing bash from 'execute' accesses on the file install-toolchains.sh. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that bash should be allowed execute access on the install-toolchains.sh file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'bash' --raw | audit2allow -M my-bash # semodule -X 300 -i my-bash.pp Additional Information: Source Context system_u:system_r:container_t:s0:c458,c759 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects install-toolchains.sh [ file ] Source bash Source Path bash Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-34.14-1.fc34.noarch Local Policy RPM selinux-policy-targeted-34.14-1.fc34.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.12.15-300.fc34.x86_64 #1 SMP Wed Jul 7 19:46:50 UTC 2021 x86_64 x86_64 Alert Count 1 First Seen 2021-07-21 06:26:31 PDT Last Seen 2021-07-21 06:26:31 PDT Local ID a8a1523e-457e-4f7b-af73-fcc28802d01e Raw Audit Messages type=AVC msg=audit(1626873991.765:820): avc: denied { execute } for pid=6430 comm="bash" name="install-toolchains.sh" dev="sdc3" ino=378832 scontext=system_u:system_r:container_t:s0:c458,c759 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0 Hash: bash,container_t,user_home_t,file,execute Version-Release number of selected component: selinux-policy-targeted-34.14-1.fc34.noarch Additional info: component: selinux-policy reporter: libreport-2.15.2 hashmarkername: setroubleshoot kernel: 5.12.15-300.fc34.x86_64 type: libreport
I follow the instructions to create a local policy module but then I get a "read, open" error instead. I then created another local policy module but then got an "execute_no_trans" error instead. I added yet another module but then cat failed instead: ` cat: jni/deltachat-core-rust/rust-toolchain: Permission denied ` Which is where I finally gave up.
Accessing files from the host inside a container [confined by SELinux] requires that the files are first relabeled to container_file_t. In your case, using the "z" volume option when invoking `podman run` should take care of it automatically: podman run --userns=keep-id -it --name deltachat -v $(pwd):/home/app:z -w /home/app localhost/deltachat-android
Thank you very much Ondrej! That worked!