Skip to content

Various small fixes #4119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
elmarco wants to merge 4 commits into
base: main
Choose a base branch
from
+15 −9
Open

Various small fixes #4119

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
32c8ef9
Fix ~/.local/bin installation instructions
elmarco Jan 13, 2026
0ce330a
Don't copy IMA attributes, that requires CAP_MAC_ADMIN
elmarco Jan 13, 2026
45c5ef4
mkosi-tools: install systemd-boot-unsigned on fedora
elmarco Jan 13, 2026
8b9a7aa
qemu: remove dead code
elmarco Jan 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ might have to add `~/.local/bin` to your user's `PATH`.

```shell
git clone https://github.com/systemd/mkosi
ln -s $PWD/mkosi/bin/mkosi ~/.local/bin/mkosi
ln -s $PWD/bin/mkosi ~/.local/bin/mkosi
mkosi --version
```

Expand Down
1 change: 1 addition & 0 deletions mkosi/resources/mkosi-tools/mkosi.conf.d/fedora/mkosi.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,4 @@ Packages=
erofs-utils
pkcs11-provider
python3-pefile
systemd-boot-unsigned
13 changes: 13 additions & 0 deletions mkosi/tree.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,12 @@ def tree_has_selinux_xattr(path: Path) -> bool:
)


def tree_has_ima_xattr(path: Path) -> bool:
return any(
"security.ima" in os.listxattr(p, follow_symlinks=False) for p in (path, *path.rglob("*"))
)
Comment on lines +102 to +104
Copy link
Contributor

@behrmann behrmann Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ruff complains

Suggested change
return any(
"security.ima" in os.listxattr(p, follow_symlinks=False) for p in (path, *path.rglob("*"))
)
return any("security.ima" in os.listxattr(p, follow_symlinks=False) for p in (path, *path.rglob("*")))

Copy link
Author

@elmarco elmarco Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

c&p from tree_has_selinux_xattr. We may want to generalize the function instead.

Copy link
Contributor

@behrmann behrmann Jan 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ruff complains here because security.ima is shorter than security.selinux and therefore this fits on a single line. Either way, this needs to be addressed.



def copy_tree(
src: Path,
dst: Path,
Expand All @@ -118,9 +124,16 @@ def copy_tree(
attrs = "mode,links"
if preserve:
attrs += ",timestamps,ownership"
with_xattrs = True

# Trying to copy selinux xattrs to overlayfs fails with "Operation not supported" in containers.
if statfs(os.fspath(dst.parent)) != OVERLAYFS_SUPER_MAGIC or not tree_has_selinux_xattr(src):
with_xattrs = False

if tree_has_ima_xattr(src):
with_xattrs = False
Comment on lines +133 to +134
Copy link
Contributor

@behrmann behrmann Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems problematic, since even if we decided to e.g. copy xattr to keep selinux attributes around, we'd drop them if a file also has these xattrs.

Despite being a bit annoying is there any issue with the warning from cp?

Copy link
Author

@elmarco elmarco Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cp fails with exit 1

Copy link
Contributor

@behrmann behrmann Jan 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, but since this is the same as security.selinux then, shouldn't it be be

statfs(os.fspath(dst.parent)) != OVERLAYFS_SUPER_MAGIC 
or (not tree_has_selinux_xattr(src) and not tree_has_ima_xattr(src))

then?


if with_xattrs:
attrs += ",xattr"

def copy() -> None:
Expand Down