Bug 2326348 - Lots of "Could not set context for /var/lib/selinux/targeted/tmp/modules/...: Operation not supported" messages when building image mode images
Summary: Lots of "Could not set context for /var/lib/selinux/targeted/tmp/modules/...:...
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: libsemanage
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Vit Mojzis
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-11-14 20:24 UTC by Jonathan Lebon
Modified: 2024-12-19 19:22 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-12-19 19:22:53 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHEL-70632 0 None None None 2024-12-10 17:07:08 UTC

Description Jonathan Lebon 2024-11-14 20:24:21 UTC
To reproduce, build any tier for rawhide from the base-images repo (https://gitlab.com/fedora/bootc/base-images). E.g.:

```
$ podman build --security-opt=label=disable --cap-add=all   --device /dev/fuse -t quay.io/jlebon/fedora-bootc:tier-x . --build-arg MANIFEST=fedora-tier-x.yaml --from quay.io/fedora/fedora:rawhide
...
passt-selinux.post: Could not set context for /etc/selinux/targeted/tmp/modules/100/rtas/lang_ext:  Operation not supported
passt-selinux.post: Could not set context for /etc/selinux/targeted/tmp/modules/100/rtas:  Operation not supported
passt-selinux.post: Could not set context for /etc/selinux/targeted/tmp/modules/100/rtkit/cil:  Operation not supported
passt-selinux.post: Could not set context for /etc/selinux/targeted/tmp/modules/100/rtkit/hll:  Operation not supported
...
Could not set context for /etc/selinux/targeted/tmp/commit_num:  Operation not supported
Could not set context for /etc/selinux/targeted/tmp/file_contexts:  Operation not supported
Could not set context for /etc/selinux/targeted/tmp/file_contexts.homedirs:  Operation not supported
```

https://src.fedoraproject.org/rpms/selinux-policy/pull-request/480 fixed it for selinux-policy-targeted itself, but basically any package that installs SELinux modules would need to do the same change. As well, recompiling the policy (like rpm-ostree does during the compose) triggers the warnings. Which I think overall argues for fixing the tooling itself to not warn.

See also https://gitlab.com/fedora/bootc/tracker/-/issues/45

Reproducible: Always

Comment 1 Jonathan Lebon 2024-11-14 20:26:54 UTC
Also, squashing stderr entirely means that meaningful errors can no longer be seen during the compose.


Note You need to log in before you can comment on or make changes to this bug.