Skip to content

Automotive initial work #928

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
May 22, 2025

Conversation

alexlarsson
Copy link
Contributor

@alexlarsson alexlarsson commented May 13, 2025

This is some initial work for supporting bootc in the automotive projects. It includes the following:

  • Extract the active selinux policy from the image
  • Support specifying a custom build container image ref

This depends on: osbuild/images#1519

@alexlarsson
Copy link
Contributor Author

I'm not sure what exactly is going wrong in the tests, but my guess is that it is caused by the verity change. I'm gonna try reverting that for now.

@alexlarsson alexlarsson force-pushed the automotive-initial-work branch 3 times, most recently from ff9f4a6 to 8e12982 Compare May 14, 2025 13:22
@alexlarsson
Copy link
Contributor Author

The CI failure is:

dracut[E]: Module 'prefixdevname-tools' cannot be found.

Which doesn't seem related to this change.

Copy link
Member

@achilleas-k achilleas-k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM so far. Holding off until images PR is merged.

One note about commit messages: Can you amend commit message to follow the preferred format?

Thanks!

@achilleas-k
Copy link
Member

The CI failure is:

dracut[E]: Module 'prefixdevname-tools' cannot be found.

Which doesn't seem related to this change.

It seems there's a bunch of stuff failing in that dracut stage. Yes, it's unrelated. I'll look into it.

@achilleas-k
Copy link
Member

Opened #929 to update the images dependency to the latest release. I suspect something might have changed that is causing these issues. Either that, or it's a package / dracut module change (again). Either way, it should show up there and if not it'll minimise the changes being pulled into this PR.

@alexlarsson alexlarsson force-pushed the automotive-initial-work branch from 8e12982 to 29cde77 Compare May 15, 2025 15:44
@alexlarsson
Copy link
Contributor Author

I rebased this with some changes, and fixes to the commit messages.
This version depends on the API fixes in osbuild/images#1526,.
It also contains a commit to handle an API changes that happened upstream in osbuild-image.

@achilleas-k
Copy link
Member

#929 fixed the dracut stage issue and got merged.

@achilleas-k achilleas-k self-requested a review May 15, 2025 18:04
@alexlarsson alexlarsson force-pushed the automotive-initial-work branch from 29cde77 to 63c6937 Compare May 16, 2025 08:03
@alexlarsson
Copy link
Contributor Author

@achilleas-k Cool, i rebased on master, lets see if it passes CI now.

@alexlarsson alexlarsson force-pushed the automotive-initial-work branch 2 times, most recently from df56bbd to 25ef903 Compare May 16, 2025 11:47
Copy link
Member

@achilleas-k achilleas-k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Tentative LGTM (pending images PR merge).

@alexlarsson
Copy link
Contributor Author

It's failing this:

test/test_build_disk.py::test_image_build_without_se_linux_denials[container_ref=quay.io/fedora/fedora-bootc:43,disk_config=btrfs,image=raw,rootfs=btrfs,use_librepo=True] FAILED [ 20%]

Which may be related to this change actually.

@alexlarsson
Copy link
Contributor Author

No, this seems to be some package issue, it seems to have the right arguments to the selinux labeling stage:

E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]: org.osbuild.selinux: 4583053c66b472861fdb1f91277d7995cd58efc7ecd248ee94b9da7d6d2780ce {
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:   "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:   "exclude_paths": [
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:     "/sysroot"
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:   ],
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:   "labels": {
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:     "/usr/bin/mount": "system_u:object_r:install_exec_t:s0",
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:     "/usr/bin/ostree": "system_u:object_r:install_exec_t:s0",
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:     "/usr/bin/umount": "system_u:object_r:install_exec_t:s0"
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]:   }
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]: }

But then it reports errors loading this policy:

E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]: setfiles: /run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts.bin:  line 1 error due to: Non-ASCII characters found
E         May 16 12:19:31 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 nostalgic_liskov[18378]: setfiles: /run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts.homedirs.bin:  line 1 error due to: Non-ASCII characters found
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_homed_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_tpm2_generator_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_generic_generator_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_bootc_generator_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:kdump_dep_generator_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_ssh_generator_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_pcrlock_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_homework_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_pcrextend_exec_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_homed_unit_file_t:s0 is not valid (left unmapped).
E         May 16 12:19:39 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 kernel: SELinux:  Context system_u:object_r:systemd_user_runtimedir_exec_t:s0 is not valid (left unmapped).

And later we see the result of this causing labeling to not be correct:

E         May 16 12:19:53 98bb73fd-772e-431a-a6ea-b7dd16b5cf15 audit[19046]: AVC avc:  denied  { nnp_transition nosuid_transition } for  pid=19046 comm="bootc" scontext=system_u:system_r:install_t:s0:c541,c788 tcontext=system_u:system_r:container_runtime_t:s0:c541,c788 tclass=process2 permissive=0

@alexlarsson alexlarsson force-pushed the automotive-initial-work branch from 25ef903 to 4e5681f Compare May 20, 2025 07:08
@alexlarsson
Copy link
Contributor Author

Ok, new version that is rebased on latest, now using the osbuild/images commit with the merged PR.

@alexlarsson
Copy link
Contributor Author

Note: I'm not sure what the policy is on depending on a non-versioned osbuild/image commit id like this. We should maybe do a osbuild/images release first. But if so, I would like osbuild/images#1543 to land first, as I want to use that with bc-i-b too.

@alexlarsson
Copy link
Contributor Author

CI is failing with out of disk errors when building some test container image:

Running transaction
Transaction failed: Rpm transaction failed.
  - installing package golang-1.24.3-2.fc42.x86_64 needs 3MB more space on the / filesystem
  - installing package less-668-2.fc42.x86_64 needs 4MB more space on the / filesystem
  - installing package git-core-2.49.0-1.fc42.x86_64 needs 17MB more space on the / filesystem
  - installing package git-core-doc-2.49.0-1.fc42.noarch needs 18MB more space on the / filesystem
  - installing package perl-Git-2.49.0-1.fc42.noarch needs 19MB more space on the / filesystem
......
Error: building at STEP "RUN dnf install -y git-core golang gpgme-devel libassuan-devel && mkdir -p /build/bib": while running runtime: exit status 1
_ ERROR at setup of test_manifest_smoke[container_ref=quay.io/fedora/fedora-bootc:42,rootfs=btrfs,use_librepo=True] _

arch.FromString can now return an error
Currently we are always hardcoding "targeted", which is not working
for the centos automotive sig that use a custom policy.
The automotive project wants to build minimal bootc images which will
not contain tools like dnf, mkfs.ext, etc. We support this by allowing
the container used in the build pipeline to come from another (but
related) container image.

This depends on osbuild/images#1507
This rewrites the partition table after creation so that it works
both with filesystem and disk customizations.
@alexlarsson alexlarsson force-pushed the automotive-initial-work branch from c785c4a to ac75d33 Compare May 22, 2025 10:10
Copy link
Member

@achilleas-k achilleas-k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@achilleas-k achilleas-k merged commit 44e794a into osbuild:main May 22, 2025
19 of 20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants