No label found in policy 'None'

[wkornewald]

When applying an update I get the error

ERROR Upgrading: Staging: Pulling bound images: Creating imgstorage: Labeling imgstorage dirs: labeling storage root: No label found in policy 'None' for /var/lib/containers/storage

Note that I have disabled SELinux (no time or desire to debug the many problems caused by this over-complicated mess).

[cgwalters]

Note that I have disabled SELinux (no time or desire to debug the many problems caused by this over-complicated mess).

OK. Yes, I think we recently regressed here in the no-selinux case.

[ckyrouac]

@wkornewald I'm having trouble reproducing this. Could you show me the output of ls -alZ /sysroot/ostree/bootc/storage on your system? I'm also curious how you provisioned your system initially and how you disabled SELinux. Did you start from a base image, e.g. FROM quay.io/fedora/fedora-bootc:41 or something else? It'd be really helpful if you could show me the Containerfile you used to build the image.

[wkornewald]

# ls -alZ /sysroot/ostree/bootc/storage
total 152
drwxr-xr-x 8 root root ?   4096 Apr 23 23:27 .
drwxr-xr-x 3 root root ?   4096 Apr 30 01:00 ..
-rw-r--r-- 1 root root ? 114688 Apr 23 23:27 db.sql
-rw-r--r-- 1 root root ?      8 Apr 23 23:27 defaultNetworkBackend
drwx------ 2 root root ?   4096 Apr 23 23:27 libpod
drwx------ 3 root root ?   4096 Apr 30 01:00 overlay
drwx------ 2 root root ?   4096 Apr 23 23:27 overlay-containers
drwx------ 2 root root ?   4096 Apr 23 23:27 overlay-images
drwx------ 2 root root ?   4096 Apr 23 23:27 overlay-layers
-rw-r--r-- 1 root root ?     64 Apr 30 01:00 storage.lock
-rw-r--r-- 1 root root ?      0 Apr 23 23:27 userns.lock
drwx------ 2 root root ?   4096 Apr 23 23:27 volumes

The Containerfile copies a few files into the image and runs the image build script and deletes the image build files afterwards (part of init.sh):

FROM quay.io/fedora/fedora-bootc:latest
ENV BUILDING_IMAGE=1
COPY fs /
RUN /image/init.sh

The build system and server both use aarch64.

The target drive was partitioned manually, but mostly because I migrated from an x64 mini server and wanted to preserve some folders in /var/. The installation then looked like this:

mount "$rootpart" /mnt
cd /mnt

# Remove any existing installation
# Note: here I usually also mv some folders from ostree/deploy/default/var/ that I want to keep
chattr -i -a boot/efi ostree/deploy/default/deploy/*
rm -rf boot ostree

mkdir -p boot/efi
mkfs.vfat -n EFI-SYSTEM "$efipart"
mount "$efipart" boot/efi

podman run --rm -it --privileged --pid=host -v /:/target -v /var/lib/containers:/var/lib/containers -v /dev:/dev --security-opt label=type:unconfined_t --net=host localhost:1234/myimage:latest bootc install to-filesystem --disable-selinux --skip-fetch-check --replace=alongside /target/mnt/

umount boot/efi

# optionally mv any rescued var folders back into ostree/deploy/default/var/
# ...

cd /
umount /mnt

Also my /etc/selinux/config:

SELINUX=disabled
SELINUXTYPE=targeted

And my /usr/lib/bootc/kargs.d/10-selinux.toml:

kargs = ["selinux=0"]

So, SELinux was disabled at install time and in two configs to fully get rid of it.

[cgwalters]

optionally mv any rescued var folders back into ostree/deploy/default/var/

Tangential but we want to support this better in #404

[ckyrouac]

thanks for the details! I was able to reproduce this by completely removing the selinux policies via dnf remove -y selinux-policy-targeted --setopt protected_packages=. The fix is in #1321