Created attachment 888771 [details] build.log podman's Makefile makes an unfortunate assumption about the loaded SELinux policy and tries to relabel the podman binary with a type that doesn't exist in Gentoo's policy (container_runtime_exec_t vs. podman_exec_t). It seems setting SELINUXOPT to an empty value successfully tricks the build system to skip its SELinux relabeling step, then Portage will take care of it like normal.
*** Bug 927708 has been marked as a duplicate of this bug. ***
Since my (reported-first) bug was closed as a dup of this newer one, I'll re-add that this needs to be solved by packaging container-selinux[1] for Gentoo: [1] https://github.com/containers/container-selinux/
(In reply to Ed Santiago from comment #2) > Since my (reported-first) bug was closed as a dup of this newer one, I'll > re-add that this needs to be solved by packaging container-selinux[1] for > Gentoo: > > [1] https://github.com/containers/container-selinux/ I closed your bug because the purported fix is incorrect. container-selinux is not compatible with Gentoo's SELinux policy. For podman specifically, we have sec-policy/selinux-podman which contains the correct type podman_exec_t. You can workaround this for now by setting SELINUXOPT to an empty value when building podman, e.g.: SELINUXOPT= emerge podman
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=932b12cd4319a206933e1f548d0913ecbc1e8b91 commit 932b12cd4319a206933e1f548d0913ecbc1e8b91 Author: Kenton Groombridge <concord@gentoo.org> AuthorDate: 2024-10-24 15:11:00 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2024-10-24 19:51:28 +0000 app-containers/podman: fix SELinux relabeling The Makefile relabels the podman executable during installation and defaults to using container_runtime_exec_t which does not exist in Gentoo's SELinux policies. Disable the automatic relabeling during install and let portage take care of it to avoid this error. Closes: https://bugs.gentoo.org/927966 Signed-off-by: Kenton Groombridge <concord@gentoo.org> From: https://github.com/gentoo/gentoo/pull/39098 Signed-off-by: Zac Medico <zmedico@gentoo.org> app-containers/podman/podman-4.9.4.ebuild | 2 +- app-containers/podman/podman-5.0.2.ebuild | 4 ++-- app-containers/podman/podman-5.0.3.ebuild | 4 ++-- app-containers/podman/podman-5.1.1.ebuild | 4 ++-- app-containers/podman/podman-5.2.4.ebuild | 4 ++-- app-containers/podman/podman-9999.ebuild | 4 ++-- 6 files changed, 11 insertions(+), 11 deletions(-)
