-
-
Notifications
You must be signed in to change notification settings - Fork 5.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Document issues with podman/selinux #23623
Comments
Thanks for tracing through all of this :) note: I tagged this as theme/docker as it was the closest |
Of course! I realize podman is not officially supported (and selinux is its own pain) but I figured this was the first place people would search for issues, so if I can document a solution somewhere hopefully it is useful :) |
One workaround is to set sshd_t to permissive by |
This appears to work.
make -f /usr/share/selinux/devel/Makefile sudo semodule -i `gitea-sshd.pp` I'm not sure how to move forward with this, do we distribute rpm's with the appropriate selinux policy for the host? Do we just include those instructions in an "WARNING: SELINUX INSTRUCTIONS" somewhere in the gitea docs? Does it live in podman (containers/podman#17883 (comment) cc @rhatdan) |
At least on the RHEL family of distributions, there's a builtin selinux bool that allows this exact thing:
Works here on Alma Linux 9. |
Feature Description
I run Fedora/CoreOS and as such was following along the docker rootless tutorial using podman.
After following the section on enabling ssh passthrough, it will silently fail due to selinux permission issues.
If you try to clone a git repo:
As seen in systemd-journal with
sudo journalctl -feu sshd
:The underlying culprit can be viewed in the SELinux logs:
I'm opening this issue for visibility incase others attempt to use rootless podman with ssh forwarding. I've also opened an issue with podman: containers/podman#17883. I'm trying to debug this/come up with a good workaround (or installable selinux policy). Feel free to close, but I'll also document here how to use gitea/podman/coreos once I figure it out.
The text was updated successfully, but these errors were encountered: