The Fedora (37) template built with "selinux" option, but using "docker" executor (on ubuntu host, which doesn't have SELinux enabled), not "qubes" one, results in a broken template.
Steps to reproduce
Build the fedora-37 template using example-configs/qubes-os-r4.2.yml but with docker executor instead of qubes one (there is a commented out section for it already there).
Expected behavior
Fully functional template, or a build error if docker cannot be used for building selinux-enabled template.
Actual behavior
The system fails to boot. Highlights from the log:
[ 3.258712] audit: type=1403 audit(1683806420.306:3): auid=4294967295 ses=4294967295 lsm=selinux res=1
[ 3.260155] systemd[1]: Successfully loaded SELinux policy in 47.376ms.
[ 3.270853] systemd[1]: Relabelled /dev, /dev/shm, /run, /sys/fs/cgroup in 4.356ms.
[ 3.275999] systemd[1]: systemd 251.14-2.fc37 running in system mode (+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP -GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN -IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified)
[ 3.276071] systemd[1]: Detected virtualization xen.
[ 3.276085] systemd[1]: Detected architecture x86-64.
Welcome to Fedora Linux 37 (Thirty Seven)!
[ 3.277333] systemd[1]: No hostname configured, using default hostname.
[ 3.277382] systemd[1]: Hostname set to <fedora>.
[ 3.302945] systemd[1]: bpf-lsm: BPF LSM hook not enabled in the kernel, BPF LSM not supported
[ 3.401358] systemd-gpt-auto-generator[213]: Failed to dissect: Permission denied
[ 3.403207] (sd-execut[205]: /usr/lib/systemd/system-generators/systemd-gpt-auto-generator failed with exit status 1.
and
[ 4.001953] audit: type=1400 audit(1683806421.049:4): avc: denied { write } for pid=254 comm="qubesdb-daemon" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:qubes_qubesdb_daemon_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=0
[ 4.004098] systemd[1]: qubes-db.service: Main process exited, code=exited, status=1/FAILURE
[ 4.004204] systemd[1]: qubes-db.service: Failed with result 'exit-code'.
[ 4.004342] systemd[1]: Failed to start qubes-db.service - Qubes DB agent.
[FAILED] Failed to start qubes-db.service - Qubes DB agent.
See 'systemctl status qubes-db.service' for details.
[ 4.004752] systemd[1]: Dependency failed for qubes-sysinit.service - Init Qubes Services settings.
How to file a helpful issue
Qubes OS release
R4.2
Brief summary
The Fedora (37) template built with "selinux" option, but using "docker" executor (on ubuntu host, which doesn't have SELinux enabled), not "qubes" one, results in a broken template.
Steps to reproduce
Build the fedora-37 template using
example-configs/qubes-os-r4.2.yml
but with docker executor instead of qubes one (there is a commented out section for it already there).Expected behavior
Fully functional template, or a build error if docker cannot be used for building selinux-enabled template.
Actual behavior
The system fails to boot. Highlights from the log:
and
full log at https://gist.github.com/marmarek/39abce5927bfaf76c15652ccc79d4ff3
Some labels are seemingly set (full file listing is 12MB, but you can see some of them in the log above): https://gist.github.com/marmarek/ddffbe87717eff30e9424925d70f35e4 (generated with
find /mnt -printf '%M %U %G %Z %p\n'
)