Podman Fails on macOS due to SELinux Labels

[Alexhuszagh]

Checklist

• I've looked through the issues and pull requests for similar reports

Describe your issue

Related to containers/podman#13631

This bug has likely been around a long time, and reproduces on any tested cross version. Removing the SELinux labels works. You can create a simple test case with:

podman run -it --rm -v "$PWD"/target:/target:Z ubuntu:20.04 bash

And this will fail with the described error.

What target(s) are you cross-compiling for?

other (specify in description)

Which operating system is the host (e.g computer cross is on) running?

• macOS
• Windows
• Linux / BSD
• other OS (specify in description)

What architecture is the host?

• x86_64 / AMD64
• arm32
• arm64 (including Mac M1)

What container engine is cross using?

• docker
• podman
• other container engine (specify in description)

cross version

latest main build

Example

cargo install cross --git https://github.com/cross-rs/cross
git clone https://github.com/cross-rs/rust-cpp-hello-word
cd rust-cpp-hello-word
cross run --target ... # any target

Which produces an error of error preparing container $(ID) for attach: lsetxattr $(PATH): operation not supported.

Additional information / notes

It seems this is podman specific due to the description below. Basically, on macOS and with Podman, remove the SELinux labels.

[Alexhuszagh]

It looks like Podman's going to require substantial more work on macOS, and I'm not going to prioritize this right now. When I try to build with a cross built from @Alexhuszagh:cross/selinux, I get the following error:

sh: 1: cargo: Network dropped connection on reset.

[Alexhuszagh]

This other issue seems to be containers/podman#14142, which is the network being dropped in podman if run from a binary mounted from the host (IE, cargo in all our examples), except I'm running on a x86_64 host with an x86_64 image. There might be a way to do bind mount options for this.

[oherrala]

I've hit this issue (macOS 12.6, podman 4.5.0, arm64). Is there anything I could help with getting this fixed?

I see one obstacle mentioned (#756 (comment)) has been fixed: containers/podman#14142

[Emilgardis]

I think the only realistic fix for this for us is to drop the labels when the bug/limitation would happen. i.e on macos and using podman

[oherrala]

I think the only realistic fix for this for us is to drop the labels when the bug/limitation would happen. i.e on macos and using podman

@Emilgardis There's a patch (Alexhuszagh@3e2ec8a) which seems to do exactly that.

[NickGeek]

I see this was closed but I'm still running into it. Is there a regression or was a fix not merged?

[Emilgardis]

@NickGeek #1260 is only on the main branch, it hasnt been released to crates.io yet. Install from the main branch with cargo install cross --git https://github.com/cross-rs/cross