Skip to content

Lots of "Could not set context for /var/lib/selinux/targeted/tmp/modules/...: Operation not supported" messages during rawhide compose

To reproduce, build any tier for rawhide. E.g.:

$ podman build --security-opt=label=disable --cap-add=all   --device /dev/fuse -t quay.io/jlebon/fedora-bootc:tier-x . --build-arg MANIFEST=fedora-tier-x.yaml --from quay.io/fedora/fedora:rawhide
...
passt-selinux.post: Could not set context for /etc/selinux/targeted/tmp/modules/100/rtas/lang_ext:  Operation not supported
passt-selinux.post: Could not set context for /etc/selinux/targeted/tmp/modules/100/rtas:  Operation not supported
passt-selinux.post: Could not set context for /etc/selinux/targeted/tmp/modules/100/rtkit/cil:  Operation not supported
passt-selinux.post: Could not set context for /etc/selinux/targeted/tmp/modules/100/rtkit/hll:  Operation not supported
...
Could not set context for /etc/selinux/targeted/tmp/commit_num:  Operation not supported
Could not set context for /etc/selinux/targeted/tmp/file_contexts:  Operation not supported
Could not set context for /etc/selinux/targeted/tmp/file_contexts.homedirs:  Operation not supported

https://src.fedoraproject.org/rpms/selinux-policy/pull-request/480 fixed it for selinux-policy-targeted itself, but basically any package that installs SELinux modules would need to do the same change. As well, recompiling the policy (like rpm-ostree does during the compose) triggers the warnings. Which I think overall argues for fixing the tooling itself to not warn.

Edited by Jonathan Lebon
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information