lsetxattr: permission denied with podman

[TribuneX]

lsetxattr: permission denied with podman

[dickc-sg]

I receive the same error with trivyfs-docker using podman and so I do not believe this is gitleaks-specific.

Steps to reproduce:

$ brew install podman podman-desktop
$ sudo ln -s /opt/homebrew/bin/podman /usr/local/bin/docker
$ pre-commit run -a

Output:

$ pre-commit run -a
Terraform fmt............................................................Passed
Terraform validate.......................................................Passed
Terraform docs...........................................................Passed
Terraform docs...........................................................Passed
Terraform validate with tflint...........................................Passed
trivyfs-docker...........................................................Failed
- hook id: trivyfs-docker
- exit code: 126

Resolving "aquasec/trivy" using unqualified-search registries (/etc/containers/registries.conf.d/999-podman-machine.conf)
Trying to pull docker.io/aquasec/trivy:0.49.1...
Getting image source signatures
Copying blob sha256:98d61a99dbd7e853a40ec0c8f5063ed8d28cfce17ad132ea22f03a0f4f407f48
Copying blob sha256:67b5a74b6f9ebdf4d0394b6c6af6fbd6b37a055c5b6b400fc7d3719d571238e7
Copying blob sha256:bca4290a96390d7a6fc6f2f9929370d06f8dfcacba591c76e3d5c5044e7f420c
Copying blob sha256:7f344fb18575d2d29c36332a7b69a5afecbc9a935f3717edbf096e5c1d52a251
Copying config sha256:e5b7465539b3f2e0fba82eac8536d298f20e66f959e2c2a518d627bc9ba13d6a
Writing manifest to image destination
Error: preparing container d20556de0895883ad945dda386dedc8bdf55322752643427c70a9b197c64c983 for attach: lsetxattr /Users/dickc-sg/Projects/github.com/dickc-sg/sample-repo/.git/objects/8b/90e4ea1b66b95e22a6035021bfb4ca78542b5d: permission denied

check yaml...............................................................Passed
Detect hardcoded secrets.................................................Passed
prettier.................................................................Passed

Worth noting this is on macOS 14.4.1, which may or may not support lsetxattr.

[rjeffman]

It seems macOS has issues setting selinux labels with lxsetattr, which requires extended attributes.

Try to set volumes without :z.

See containers/podman#13631

[TribuneX]

Try to set volumes without :z.

@rjeffman I found similar suggestion. But how to do that for the pre-commit hook container?

[rjeffman]

@TribuneX sorry, but I have no clue on how to fix that. And I just found out today that, under Linux, you may need to have :Z depending on your use case.

In my case I'm trapped between using :rw under macOS and :Z under Linux, and I wanted to have a single solution due to my use case.