BZ 19241860: SELinux: Context system_u:object_r:*:s0 is not valid

[darkmuggle]

Builds for 4.8 are currently broken due to the following error:

+ mkdir /tmp/rootfs/boot/efi
+ mount /dev/vdb2 /tmp/rootfs/boot/efi
+ ostree admin init-fs --modern /tmp/rootfs
+ '[' xfs = ext4verity ']'
+ ostree pull-local --repo /tmp/rootfs/ostree/repo /srv/rhcos-behoward/rhcos-behoward-rhcos-4.x/tmp/repo 8f01540b6671f9da623a21a4ce7bcf2cc6a71b336c6167af6da4b8207582a3e4
[   18.183405] SELinux:  Context system_u:object_r:systemd_sleep_exec_t:s0 is not valid (left unmapped).
[   29.609268] SELinux:  Context system_u:object_r:openvswitch_load_module_exec_t:s0 is not valid (left unmapped).

[darkmuggle]

I have no clue what's going on yet, but filing the issue/bug for visability.

[cgwalters]

Is there a fatal error? That's currently expected. The cosa container is Fedora with the Fedora SELinux policy - and so is the supermin VM launched to assemble the target disk. The SELinux contexts here are for RHEL.

But that's fine and expected - the kernel is just saying "I don't know this security context, but I'm writing it anyways". The "left unmapped" bit is the kernel saying the security context will be treated as invalid for the running system. But that's fine, because we're writing a new root, not affecting our running root.

It's not even a Fedora-vs-RHEL thing - you can get the same warning when doing Fedora major (e.g. 32 -> 33) or RHEL minors (8.1 -> 8.2) or obviously RHEL majors because the new policy may have new contexts unknown to the running kernel/policy.

[cgwalters]

It might be nice to have some sort of API to silence these warnings but it'd require kernel patches. (Maybe something like echo 1 > /proc/self/attr/i_am_a_policy_upgrader)

[jlebon]

Is this from a local build? I can't find this error in the ART 4.8 pipeline builds (those are currently failing on Quay infra, though I might not have gone back far enough) and at least locally I get successful builds.