Open zlind0 opened 2 years ago
Hi and welcome!
I'm not super-familiar with that specific option in the treefile, but I have a feeling that the sepolicy
value may be coming from here:
https://github.com/coreos/rpm-ostree/blob/06b70045a5a94a3fe83fc6f2cfc7a82fe25da1a8/src/app/rpmostree-compose-builtin-tree.cxx#L454-L458
But overall I think those if (selinux)
checks may be misleading, as a non-NULL value does not mean there is a policy available. In other places, this is the more complete check that is performed to detect SELinux policy presence:
https://github.com/coreos/rpm-ostree/blob/5ae5a8e7140536e143924721c6baeb7638de392a/src/libpriv/rpmostree-postprocess.cxx#L815
I think this is a dup of https://github.com/coreos/rpm-ostree/issues/971
It makes sense to support, just needs a bit of investigation and care - and a new entry to the CI flow. As I commented in the previous issue, supporting rpm-ostree in-container - which is now a high priority due to https://github.com/coreos/enhancements/blob/main/os/coreos-layering.md - would also motivate this.
Short-term, it may be easier to leave it on during the compose but configure the OS to permissive mode.
I met the same issue when I try to compose an image from CentOS Stream 9 packages:
error: Sorting packages: Loading pkgcache branch rpmostree/pkg/acl/2.3.1-3.el9.x86__64: Failed to find metadata key rpmostree.sepolicy (signature s)
Host is Fedora 35 with rpm-ostree-2022.5-1.fc35.x86_64 and with SELinux set to permissive.
I met this issue aw well.
I met this issue aw well.
me too
Host system details Fedora 33, rpm-ostree executed by fedora coreos assembler under its docker image (quay.io/coreos-assembler/coreos-assembler)
We would like to build a minimal os which excludes SELinux function. Our project is based on Fedora CoreOS, therefore, we use fedora coreos assembler. According to documentation, we set selinux:false in TREEFILE. However, while coreos assembler executes this command:
The error
SELinux enabled, but no policy found
is raised:The expected behavior is that while setting
selinux:false
rpm-ostree don't look for any SELinux policies.By looking into the code for days, we found that this patch solves this problem, but it is not likely to solve the problem fundamentally.
In other words, in
src/libpriv/rpmostree-core.cxx:1363
:sepolicy
shoule be NULL when selinux set to false in TREEFILE, however, it has some value. We are frustrated when looking for the specific place where sepolicy was set.