Revert "container: label /run/user/*/crun as container_var_run_t" #408

sbrivio-rh · 2025-09-17T14:38:01Z

This reverts commit ae3532b ("container: label /run/user/*/crun as container_var_run_t") as it breaks basic Podman operation with pasta(1) (default rootless back-end):

Error: setting up Pasta: pasta failed with exit code 1:
Couldn't open PID file /run/user/1000/containers/networks/rootless-netns/rootless-netns-conn.pid: Permission denied

A solution is being worked on, but it's not quite ready yet, see:

#405

in the meantime, revert this to avoid widespread breakage for users.

Link: #405

Summary by Sourcery

Bug Fixes:

Undo commit ae3532b to prevent Permission denied errors when opening PID files under /run/user in rootless containers

sourcery-ai · 2025-09-17T14:38:08Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR reverts the previous SELinux policy update that labeled /run/user/*/crun as container_var_run_t by removing the associated file_context entries and type enforcement rules, restoring the policy to its prior state to prevent permission errors in rootless Podman.

File-Level Changes

Change	Details	Files
Remove SELinux labeling rules for /run/user/*/crun	Deleted file_context entry mapping /run/user/*/crun to container_var_run_t Removed allow rules granting container_var_run_t access to crun directories under /run/user Reverted commit `ae3532b` changes in container.te	`container.te`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

gemini-code-assist

Summary of Changes

Hello @sbrivio-rh, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request provides a critical, temporary fix by reverting a recent SELinux policy update that inadvertently introduced a regression in Podman's rootless networking functionality. The original change caused permission denied errors for PID files, rendering pasta(1) unusable. By rolling back this specific labeling rule, the PR restores stability for users, allowing Podman to function correctly while a more robust, long-term solution is being prepared.

Highlights

Revert of SELinux Policy Change: This pull request reverts a previous commit (ae3532b) that introduced a specific SELinux labeling rule for /run/user/*/crun.
Resolution of Podman Rootless Issue: The reverted commit caused a 'Permission denied' error, breaking basic Podman operations when using pasta(1) for rootless networking, specifically preventing the opening of PID files.
Temporary Fix for Widespread Breakage: This revert serves as an immediate measure to prevent widespread user breakage while a more comprehensive and permanent solution is actively being developed and reviewed.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

sourcery-ai

Hey there - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

gemini-code-assist

Code Review

This pull request is a revert of a previous commit that was causing permission denied errors for rootless Podman operations. The change correctly removes the problematic userdom_user_tmp_filetrans rule from container.te. The reason for the revert is clearly explained in the pull request description. This is a necessary and correct temporary fix to prevent widespread issues for users while a more permanent solution is developed. The change is approved.

sbrivio-rh · 2025-09-17T14:40:10Z

Stop spamming please?

@sourcery-ai dismiss

/gemini stop

gemini-code-assist · 2025-09-17T14:40:23Z

Hello! I noticed your comment regarding stopping bot activity. For gemini-code-assist, the /gemini stop command is not recognized. I only respond when explicitly tagged with @gemini-code-assist or when a /gemini command (like /gemini review or /gemini summary) is used. If you'd like to see the available commands, please use /gemini help.

sbrivio-rh · 2025-09-17T14:40:28Z

@Luap99 @rhatdan @giuseppe

lsm5 · 2025-09-17T14:40:36Z

would you mind rebasing on #407 . That adds rootless pasta tests.

@Luap99 @giuseppe @rhatdan

sbrivio-rh · 2025-09-17T14:41:36Z

would you mind rebasing on #407 . That adds rootless pasta tests.

@lsm5 sorry I missed that with all this spam from bots, rebasing right away!

sbrivio-rh · 2025-09-17T14:42:02Z

/gemini help srsly?

gemini-code-assist · 2025-09-17T14:42:05Z

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

sbrivio-rh · 2025-09-17T14:42:59Z

/gemini please stop this thing, I never opted in

gemini-code-assist · 2025-09-17T14:43:08Z

Hello again. I understand your frustration. The command /gemini please stop this thing, I never opted in is not a recognized command for me.

As gemini-code-assist, I only respond when explicitly tagged with @gemini-code-assist or when a specific /gemini command (like /gemini review or /gemini summary) is used. There isn't a /gemini stop command because I only activate when called upon.

My presence in this repository is typically configured by the repository maintainers, which might explain why you didn't personally opt-in. If you'd like to see the list of valid commands, please use /gemini help.

lsm5 · 2025-09-17T14:43:14Z

RE: AI bots, I think we should only have 1 bot.

@sbrivio-rh please ignore bot comments.

giuseppe

LGTM

Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

This should make local and testing-farm CLI runs rather consistent with Packit runs by enforcing the main package installation. Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

This reverts commit ae3532b ("container: label /run/user/*/crun as container_var_run_t") as it breaks basic Podman operation with pasta(1) (default rootless back-end): Error: setting up Pasta: pasta failed with exit code 1: Couldn't open PID file /run/user/1000/containers/networks/rootless-netns/rootless-netns-conn.pid: Permission denied A solution is being worked on, but it's not quite ready yet, see: containers#405 in the meantime, revert this to avoid widespread breakage for users. Link: containers#405 Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

lsm5

/lgtm
/hold

openshift-ci · 2025-09-17T14:55:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, lsm5, sbrivio-rh, sourcery-ai[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [lsm5]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

packit-as-a-service · 2025-09-17T14:58:19Z

Tests failed. @containers/packit-build please check.

Luap99

Looks like tests are still failing, is it possible that the new policy is not installed right?

Luap99 · 2025-09-17T15:07:58Z

test/podman-rootless-tests.sh

+# Run podman system tests
+su - "$ROOTLESS_USER" -c "bats /usr/share/podman/test/system/410-selinux.bats"
+su - "$ROOTLESS_USER" -c "bats /usr/share/podman/test/system/500-networking.bats"
+su - "$ROOTLESS_USER" -c bats "/usr/share/podman/test/system/505-networking-pasta.bats"


That does not actually work I think

Suggested change

su - "$ROOTLESS_USER" -c bats "/usr/share/podman/test/system/505-networking-pasta.bats"

su - "$ROOTLESS_USER" -c "bats /usr/share/podman/test/system/505-networking-pasta.bats"

ugh my bad on that one. I'll leave it to @sbrivio-rh to accept the suggestion. But it shouldn't affect 500-networking.bats.

Wait, sorry, what should I review / accept exactly?

do you see the option to Sign off and commit suggestion in @Luap99's comment ?

Well the "Sign off and commit suggestion" is just "garbage" commit message wise, it creates a new commit with a totally useless title. My recommendation is also apply the chnage locally squash it into the right commit and force push again

Luap99 · 2025-09-17T15:20:42Z

From the test log

+ rpm -q bats container-selinux passt passt-selinux podman podman-tests policycoreutils selinux-policy
bats-1.12.0-2.fc43.noarch
container-selinux-2.242.0-1.20250912094924648215.main.2.ge6cebb4.fc43.noarch

@lsm5 I assume that is the wrong rpm version, the cop builds container-selinux-4:2.242.0-1.20250917145223789020.pr408.6.gf72b241.fc43.noarch

lsm5 · 2025-09-17T15:24:01Z

From the test log
+ rpm -q bats container-selinux passt passt-selinux podman podman-tests policycoreutils selinux-policy
bats-1.12.0-2.fc43.noarch
container-selinux-2.242.0-1.20250912094924648215.main.2.ge6cebb4.fc43.noarch
@lsm5 I assume that is the wrong rpm version, the cop builds container-selinux-4:2.242.0-1.20250917145223789020.pr408.6.gf72b241.fc43.noarch

That is actually weird. Wonder if the TMT changes are to blame. I'll work on this in a followup.

I'll go ahead with merging this.

gemini-code-assist bot reviewed Sep 17, 2025

View reviewed changes

sourcery-ai bot approved these changes Sep 17, 2025

View reviewed changes

gemini-code-assist bot reviewed Sep 17, 2025

View reviewed changes

giuseppe approved these changes Sep 17, 2025

View reviewed changes

lsm5 and others added 3 commits September 17, 2025 16:50

TMT: run passt system tests from podman

a64255c

Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

TMT: additional prepare steps for consistency

5a5c9d7

This should make local and testing-farm CLI runs rather consistent with Packit runs by enforcing the main package installation. Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

sbrivio-rh force-pushed the main branch from 02d9e3b to 3fbc303 Compare September 17, 2025 14:50

lsm5 approved these changes Sep 17, 2025

View reviewed changes

openshift-ci bot assigned lsm5 Sep 17, 2025

openshift-ci bot added do-not-merge/hold lgtm labels Sep 17, 2025

openshift-ci bot added the approved label Sep 17, 2025

Luap99 reviewed Sep 17, 2025

View reviewed changes

lsm5 removed the do-not-merge/hold label Sep 17, 2025

lsm5 merged commit ed9b827 into containers:main Sep 17, 2025
17 of 32 checks passed

lsm5 mentioned this pull request Sep 17, 2025

TMT: fix tests #409

Merged

	su - "$ROOTLESS_USER" -c bats "/usr/share/podman/test/system/505-networking-pasta.bats"
	su - "$ROOTLESS_USER" -c "bats /usr/share/podman/test/system/505-networking-pasta.bats"

Revert "container: label /run/user/*/crun as container_var_run_t" #408

Revert "container: label /run/user/*/crun as container_var_run_t" #408

Uh oh!

Conversation

sbrivio-rh commented Sep 17, 2025 • edited by sourcery-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Sourcery

Uh oh!

sourcery-ai bot commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

sbrivio-rh commented Sep 17, 2025

Uh oh!

gemini-code-assist bot commented Sep 17, 2025

Uh oh!

sbrivio-rh commented Sep 17, 2025

Uh oh!

lsm5 commented Sep 17, 2025

Uh oh!

sbrivio-rh commented Sep 17, 2025

Uh oh!

sbrivio-rh commented Sep 17, 2025

Uh oh!

gemini-code-assist bot commented Sep 17, 2025

Uh oh!

sbrivio-rh commented Sep 17, 2025

Uh oh!

gemini-code-assist bot commented Sep 17, 2025

Uh oh!

lsm5 commented Sep 17, 2025

Uh oh!

giuseppe left a comment

Choose a reason for hiding this comment

Uh oh!

lsm5 left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Sep 17, 2025

Uh oh!

packit-as-a-service bot commented Sep 17, 2025

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Luap99 Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

lsm5 Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

sbrivio-rh Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

lsm5 Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

Luap99 Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

Luap99 commented Sep 17, 2025

Uh oh!

lsm5 commented Sep 17, 2025

sbrivio-rh commented Sep 17, 2025 •

edited by sourcery-ai bot

Loading

sourcery-ai bot commented Sep 17, 2025 •

edited

Loading