Fedora rawhide: container-selinux-2:2.120.1-0.2.dev.gita233788.fc32 breaks podman run

[containers]

Fedora rawhide: container-selinux-2:2.120.1-0.2.dev.gita233788.fc32 breaks podman run

[rhatdan]

This looks like the overlay storage has the wrong label on it. Should be labeled container_share_t. Could you run resstorecon -Rv /var/lib/containers.

[edsantiago]

Sorry for the late reply; I couldn't get to this yesterday.

# podman rm -a; podman rmi -a   [otherwise there's way too much output to paste]
# restorecon -Rv /var/lib/containers
[ no output. Really. ]
# ls -lZd /var/lib/containers/
drwxr-xr-x. 5 root root system_u:object_r:var_lib_t:s0 4096 Nov 23 08:40 /var/lib/containers/
                                          ^^^^^^^^^ this does not look right

# podman run alpine date
Trying to pull docker.io/library/alpine...
Getting image source signatures
Copying blob 89d9c30c1d48 done
Copying config 965ea09ff2 done
Writing manifest to image destination
Storing signatures
# echo $?
127

# chcon -t container_var_lib_t /var/lib/containers
chcon: failed to change context of '/var/lib/containers' to ‘system_u:object_r:container_var_lib_t:s0’: Invalid argument

# rpm -q container-selinux
container-selinux-2.120.1-0.2.dev.gita233788.fc32.noarch

HTH

[rhatdan]

yum reinstall container-selinux

I think the post install broke.

[edsantiago]

# dnf reinstall container-selinux
...
Running scriptlet: container-selinux-2:2.120.1-0.2.dev.gita233788.fc32.noarch                                                                             1/2
libsemanage.semanage_pipe_data: Child process /usr/libexec/selinux/hll/pp failed with code: 255. (No such file or directory).
container: libsepol.policydb_read: policydb module version 20 does not match my version range 4-19
container: libsepol.sepol_module_package_read: invalid module in module package (at section 0)
container: Failed to read policy package
libsemanage.semanage_direct_commit: Failed to compile hll files into cil files.
 (No such file or directory).
/usr/sbin/semodule:  Failed!

[rhatdan]

I don't believe this is still an issue.