Podman doesn't support SELinux labels #1260
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Awesome! It's only podman on macos which doesn't support SELinux labels, no? |
|
@Emilgardis Yes, I think this is macOS only issue and I'll change the PR to reflect that. |
e426339 to
04ab196
Compare
Emilgardis
approved these changes
May 17, 2023
There was a problem hiding this comment.
lgtm! Only needing a changeset file, see https://github.com/cross-rs/cross/blob/main/.changes/README.md
Comment on lines
+46
to
+53
| #[cfg(target_os = "macos")] | ||
| let (selinux, selinux_ro) = if engine.kind.is_podman() { | ||
| ("", ":ro") | ||
| } else { | ||
| (":z", ":z,ro") | ||
| }; | ||
| #[cfg(not(target_os = "macos"))] | ||
| let (selinux, selinux_ro) = (":z", ":z,ro"); |
There was a problem hiding this comment.
I don't think this is technically correct, rather we should get the os of the fs host and if it's using Plan 9/v9fs/9p
the problem is that the client could be different from what cross is compiled for, e.g running podman in podman
unfortunately, there doesn't seem to be a way to determine what we're on, due to the fs abstraction podman has
here's what's available
podman info -f "{{json .}}" | jq
{
"host": {
"arch": "arm64",
"buildahVersion": "1.30.0",
"cgroupManager": "systemd",
"cgroupVersion": "v2",
"cgroupControllers": [
"cpu",
"io",
"memory",
"pids"
],
"conmon": {
"package": "conmon-2.1.7-2.fc38.aarch64",
"path": "/usr/bin/conmon",
"version": "conmon version 2.1.7, commit: "
},
"cpus": 1,
"cpuUtilization": {
"userPercent": 1.63,
"systemPercent": 3.79,
"idlePercent": 94.58
},
"databaseBackend": "boltdb",
"distribution": {
"distribution": "fedora",
"variant": "coreos",
"version": "38"
},
"eventLogger": "journald",
"hostname": "localhost.localdomain",
"idMappings": {
"gidmap": [
{
"container_id": 0,
"host_id": 1000,
"size": 1
},
{
"container_id": 1,
"host_id": 100000,
"size": 1000000
}
],
"uidmap": [
{
"container_id": 0,
"host_id": 501,
"size": 1
},
{
"container_id": 1,
"host_id": 100000,
"size": 1000000
}
]
},
"kernel": "6.2.15-300.fc38.aarch64",
"logDriver": "journald",
"memFree": 1680568320,
"memTotal": 2049077248,
"networkBackend": "netavark",
"ociRuntime": {
"name": "crun",
"package": "crun-1.8.4-1.fc38.aarch64",
"path": "/usr/bin/crun",
"version": "crun version 1.8.4\ncommit: 5a8fa99a5e41facba2eda4af12fa26313918805b\nrundir: /run/user/501/crun\nspec: 1.0.0\n+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL"
},
"os": "linux",
"remoteSocket": {
"path": "/run/user/501/podman/podman.sock",
"exists": true
},
"serviceIsRemote": true,
"security": {
"apparmorEnabled": false,
"capabilities": "CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT",
"rootless": true,
"seccompEnabled": true,
"seccompProfilePath": "/usr/share/containers/seccomp.json",
"selinuxEnabled": true
},
"slirp4netns": {
"executable": "/usr/bin/slirp4netns",
"package": "slirp4netns-1.2.0-12.fc38.aarch64",
"version": "slirp4netns version 1.2.0\ncommit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383\nlibslirp: 4.7.0\nSLIRP_CONFIG_VERSION_MAX: 4\nlibseccomp: 2.5.3"
},
"swapFree": 0,
"swapTotal": 0,
"uptime": "0h 2m 43.00s",
"linkmode": "dynamic"
},
"store": {
"configFile": "/var/home/core/.config/containers/storage.conf",
"containerStore": {
"number": 0,
"paused": 0,
"running": 0,
"stopped": 0
},
"graphDriverName": "overlay",
"graphOptions": {},
"graphRoot": "/var/home/core/.local/share/containers/storage",
"graphRootAllocated": 106769133568,
"graphRootUsed": 2610094080,
"graphStatus": {
"Backing Filesystem": "xfs",
"Native Overlay Diff": "true",
"Supports d_type": "true",
"Using metacopy": "false"
},
"imageCopyTmpDir": "/var/tmp",
"imageStore": {
"number": 1
},
"runRoot": "/run/user/501/containers",
"volumePath": "/var/home/core/.local/share/containers/storage/volumes",
"transientStore": false
},
"registries": {
"search": [
"docker.io"
]
},
"plugins": {
"volume": [
"local"
],
"network": [
"bridge",
"macvlan",
"ipvlan"
],
"log": [
"passthrough",
"journald"
],
"authorization": null
},
"version": {
"APIVersion": "4.5.0",
"Version": "4.5.0",
"GoVersion": "go1.20.2",
"GitCommit": "",
"BuiltTime": "Fri Apr 14 17:41:12 2023",
"Built": 1681486872,
"OsArch": "linux/arm64",
"Os": "linux"
}
}
interestingly, server says selinux is available, oh well...
and version
podman version -f "{{json .}}" | jq
{
"Client": {
"APIVersion": "4.5.0",
"Version": "4.5.0",
"BuiltTime": "Fri Apr 14 15:28:20 2023",
"Built": 1681478900,
"OsArch": "darwin/arm64",
"Os": "darwin"
},
"Server": {
"APIVersion": "4.5.0",
"Version": "4.5.0",
"GoVersion": "go1.20.2",
"GitCommit": "",
"BuiltTime": "Fri Apr 14 17:41:12 2023",
"Built": 1681486872,
"OsArch": "linux/arm64",
"Os": "linux"
}
}
There was a problem hiding this comment.
Podman in podman is difficult. Inside podman's virtual machine everything looks like Linux.
But at least this fixes cross when ran with podman on macOS.
|
Thanks! bors r+ |
|
Build succeeded! The publicly hosted instance of bors-ng is deprecated and will go away soon. If you want to self-host your own instance, instructions are here. If you want to switch to GitHub's built-in merge queue, visit their help page. |
11 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds SELinux labels to volume mounts on other engines than Podman.
Fixes #756