RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2083570 - symlinks doesn't work on volumes under podman when SELINUX is enabled
Summary: symlinks doesn't work on volumes under podman when SELINUX is enabled
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: podman
Version: 8.6
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Jindrich Novy
QA Contact: Alex Jia
URL:
Whiteboard:
Depends On:
Blocks: 2104627
TreeView+ depends on / blocked
 
Reported: 2022-05-10 11:27 UTC by Miroslav Hostinsky
Modified: 2022-11-08 09:33 UTC (History)
12 users (show)

Fixed In Version: podman-4.1.0-1.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2104627 (view as bug list)
Environment:
Last Closed: 2022-11-08 09:15:45 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-121556 0 None None None 2022-05-10 11:34:40 UTC
Red Hat Product Errata RHSA-2022:7457 0 None None None 2022-11-08 09:16:34 UTC

Description Miroslav Hostinsky 2022-05-10 11:27:03 UTC 
Description of problem:

Today I upgraded to RHEL 8.6 (with podman 4.0) and symlinks in volumes (-v) are not relabelled with proper selinux context (:Z or :z).

Steps to Reproduce:
1. podman run -it --rm -v /root/test:/test:Z alpine ln -s /var/log /test/log
2. podman run -it --rm -v /root/test:/test:Z alpine ls -l /test

Actual results:

When podman is executed with volume which contains symlink, the symlink is not properly labelled with new context (there is :Z flag).

I really don't understand how it possible, that RHEL 8.6 went public today and this bug still exists in 8.6 release (it seems that it's the same as BUG 2074090).
Comment 1 Daniel Walsh 2022-05-10 14:23:09 UTC 
Fixed in podman 4.1
Comment 2 Tom Sweeney 2022-05-10 18:12:51 UTC 
Setting to post and assigning to Jindrich for any further BZ or packaging needs.  Podman v4.1 is on scheduled to ship with RHEL 8.6.0.2.
Comment 3 Jindrich Novy 2022-05-11 06:55:58 UTC 
Can we get qa ack please?
Comment 4 Alex Jia 2022-05-12 08:21:27 UTC 
There is no 'permission denied' is found on podman-4.1.0-2.module+el8.7.0+15223+3987d347.

[root@kvm-06-guest39 ~]# mkdir /root/test
[root@kvm-06-guest39 ~]# echo test > /root/test/foobar.txt
[root@kvm-06-guest39 ~]# podman run -it --rm -v /root/test:/test:Z alpine ln -s /var/log /test/log
[root@kvm-06-guest39 ~]# podman run -it --rm -v /root/test:/test:Z alpine ls -l /test
total 4
-rw-r--r--    1 root     root             5 May 12 07:58 foobar.txt
lrwxrwxrwx    1 root     root             8 May 12 07:59 log -> /var/log

[root@kvm-06-guest39 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.7 Beta (Ootpa)

[root@kvm-06-guest39 ~]# rpm -q podman runc systemd kernel
podman-4.1.0-2.module+el8.7.0+15223+3987d347.x86_64
runc-1.0.3-6.module+el8.7.0+15223+3987d347.x86_64
systemd-239-58.el8.x86_64
kernel-4.18.0-387.el8.x86_64
Comment 7 Alex Jia 2022-05-13 15:56:26 UTC 
Close this bug per Comment 4.
Comment 17 Daniel Walsh 2022-06-06 18:44:47 UTC 
Are these different versions of Podman?
Comment 18 Jan Pazdziora (Red Hat) 2022-06-06 20:36:12 UTC 
Indeed.

RHEL 8.6 rebased to podman-4.0.2-6.module+el8.6.0+14673+621cb8be while RHEL 8.5 where things work has podman-3.3.1-9.module+el8.5.0+12697+018f24d7.
Comment 19 Daniel Walsh 2022-06-07 12:34:21 UTC 
Looks like there could have been a regression.  This should be fixed in 8.6.0.2 with podman 4.1
Comment 20 Jan Pazdziora (Red Hat) 2022-06-13 16:30:16 UTC 
Is there a bugzilla tracking that 8.6.z work?
Comment 21 Tom Sweeney 2022-06-28 22:02:45 UTC 
I believe this BZ started out to track for 8.6.z, but has morphed to 8.7.0.  The fix is contained in Podman v4.1.1 which shipped with the 8.6.0.2 bits.  @jnovy do we need to clone this for errata needs?  I'm fine avoiding the overhead unless you need it for packaging.
Comment 26 errata-xmlrpc 2022-11-08 09:15:45 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: container-tools:rhel8 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:7457
Note You need to log in before you can comment on or make changes to this bug.