BUG: Problem with selinux/runc>=1.0.0-rc7 #3045
Description
After building podman from master for #2887, I encountered a bug that is either due to podman, selinux or runc. I'm starting to file here, because I don't know if this is actually a runc-problem, because I'm encountering it when running podman, and because the usual crowd here (esp. @rhatdan) seems to be active in all three projects anyway.
Assume we have a simple file test.dockrf:
FROM docker.io/library/ubuntu:bionic
ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
&& apt-get install -y --no-install-recommends curl
CMD ["bash"]
Then, after building runc (and podman) from master as described in the tutorial, I get:
$ sudo podman build -f test.dockrf . --no-cache
STEP 1: FROM docker.io/library/ubuntu:bionic
STEP 2: ARG DEBIAN_FRONTEND=noninteractive
--> Using cache 2e22fdc5b41c5884242479a9aec8d4f3f8f5565ff7a091b39d40760ad34852f7
STEP 3: FROM 2e22fdc5b41c5884242479a9aec8d4f3f8f5565ff7a091b39d40760ad34852f7
STEP 4: RUN apt-get update && apt-get install -y --no-install-recommends curl
selinux label is specified in config, but selinux is disabled or not supported
error running container: error creating container for [/bin/sh -c apt-get update && apt-get install -y --no-install-recommends curl]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[apt-get update && apt-get install -y --no-install-recommends curl] Flags:[] Attrs:map[] Message:RUN apt-get update && apt-get install -y --no-install-recommends curl Original:RUN apt-get update && apt-get install -y --no-install-recommends curl}: error while running runtime: exit status 1
I know there were some updates of runc regarding selinux recently, but it seems not everything is working yet (but then again, this might just be on the podman side). In any case, the container build succeeds for runc versions 1.0.0-rc4, 1.0.0-rc5, 1.0.0-rc6, but fails for 1.0.0-rc7, 1.0.0-rc8, and master.
The selinux config is from a vanilla azure RHEL machine:
$ cat /etc/sysconfig/selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of three two values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted