Skip to content

lsm: Forcibly relabel all initial state#294

Closed
cgwalters wants to merge 1 commit intobootc-dev:mainfrom
cgwalters:load-policy-not-chcon
Closed

lsm: Forcibly relabel all initial state#294
cgwalters wants to merge 1 commit intobootc-dev:mainfrom
cgwalters:load-policy-not-chcon

Conversation

@cgwalters
Copy link
Copy Markdown
Collaborator

@cgwalters cgwalters commented Feb 1, 2024

This is attempting to handle the "install selinux-enabled target from selinux-disabled host". We're kind of papering over effectively ostree design bugs here as in this case libostree itself should be setting the labels, but doing that is a bit hard and awkward right now.

@cgwalters
lsm: Forcibly relabel all initial state
ac0bd17 
This is attempting to handle the "install selinux-enabled target from selinux-disabled host".
We're kind of papering over effectively ostree design bugs here
as in this case libostree itself should be setting the labels,
but doing that is a bit hard and awkward right now.

Signed-off-by: Colin Walters <walters@verbum.org>
@openshift-ci
Copy link
Copy Markdown

openshift-ci Bot commented Feb 1, 2024

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@github-actions github-actions Bot added the area/install Issues related to `bootc install` label Feb 1, 2024
@cgwalters cgwalters mentioned this pull request Feb 1, 2024
Merged
cgwalters added a commit to cgwalters/bootc-image-builder that referenced this pull request Feb 14, 2024
@cgwalters
Mount /boot ro by default
496907c 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde osbuild#18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
cgwalters added a commit to cgwalters/bootc-image-builder that referenced this pull request Feb 14, 2024
@cgwalters
Mount /boot ro by default
3cc02ee 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde osbuild#18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
@cgwalters cgwalters mentioned this pull request Feb 14, 2024
Merged
@bcl
Copy link
Copy Markdown

bcl commented Feb 14, 2024

This seems like a good idea to me, but I'm not sure I have a good enough grasp of all the moving parts to ack it :) Also, is there any testing that would cover this, or does the current test suite passing inherently prove it doesn't break things?
Not sure what's up with the failing test, those look like rust errors.

cgwalters added a commit to cgwalters/bootc-image-builder that referenced this pull request Feb 14, 2024
@cgwalters
Mount /boot ro by default
0da5251 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde osbuild#18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
github-merge-queue Bot pushed a commit to osbuild/bootc-image-builder that referenced this pull request Feb 15, 2024
@cgwalters
Mount /boot ro by default
711f39b 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde #18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
@cgwalters
Copy link
Copy Markdown
Collaborator Author

cgwalters commented Feb 15, 2024

Not sure what's up with the failing test, those look like rust errors.

Just to explain this a bit...the bootc install is a cargo feature that can be disabled. Basically some operating systems/distros may have their own installer and don't want to support bootc carrying its own.

(That said increasingly I'm thinking at least bootc install-to-filesystem should always be on...but bootc install-to-disk is way more opinionated and something that one might want to replace)

@cgwalters
Copy link
Copy Markdown
Collaborator Author

cgwalters commented Mar 18, 2024

Actually forgot I'd started on this one here. This is obsoleted by #397

@cgwalters cgwalters closed this Mar 18, 2024
mvo5 pushed a commit to mvo5/image-builder-cli that referenced this pull request Nov 19, 2025
@cgwalters @mvo5
Mount /boot ro by default
8f2d149 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde osbuild/bootc-image-builder#18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
mvo5 pushed a commit to mvo5/image-builder-cli that referenced this pull request Nov 25, 2025
@cgwalters @mvo5
Mount /boot ro by default
9e99e4a 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde osbuild/bootc-image-builder#18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
mvo5 pushed a commit to mvo5/image-builder-cli that referenced this pull request Nov 27, 2025
@cgwalters @mvo5
Mount /boot ro by default
8890a68 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde osbuild/bootc-image-builder#18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
mvo5 pushed a commit to mvo5/image-builder-cli that referenced this pull request Dec 3, 2025
@cgwalters @mvo5
Mount /boot ro by default
f1d45ae 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde osbuild/bootc-image-builder#18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
mvo5 pushed a commit to mvo5/image-builder-cli that referenced this pull request Dec 8, 2025
@cgwalters @mvo5
Mount /boot ro by default
efed989 
See bootc-dev/bootc#294
This is particularly motivated by CentOS/centos-bootc-dev#27
because with that suddenly `dnf` will appear to start working
but trying to do anything involving the kernel (i.e. mutating `/boot`)
will end in sadness, and this puts a stop to that.

(This also relates of course to ye olde osbuild/bootc-image-builder#18
 where we want the partitioning setup in the default case
 to come from the container)

Signed-off-by: Colin Walters <walters@verbum.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/install Issues related to `bootc install` do-not-merge/work-in-progress

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cgwalters @bcl