podman relabel issue

[tazihad]

Issue Description

A strange issue. I have extracted ventoy and used this to format a USB. However after this my podman command stopped working.
Command:

podman run -d \
  --name=qbittorrent \
  --restart=on-failure \
  --network=host \
  --userns=keep-id \
  --user root \
  -e PUID=1000 \
  -e PGID=1000 \
  -e QBT_WEBUI_PORT=58080 \
  -v qbittorrent-config:/config \
  -v $HOME/Downloads:/downloads:Z \
  docker.io/qbittorrentofficial/qbittorrent-nox:latest

error:

Error: lsetxattr(label=system_u:object_r:container_file_t:s0:c438,c654) /home/zihad/Downloads/ventoy-1.1.07/Ventoy2Disk.ini: operation not permitted

I don't understand why a ventoy file not letting me mount this directory. If I delete the ventoy directory. Podman command works.

This is on Fedora 43

Steps to reproduce the issue

Steps to reproduce the issue

1. Use extract and use ventoy
2. run the podman command and try to mount the directory ventoy exist
3. It throws relabel error.

Describe the results you received

Describe the results you receivedError: lsetxattr(label=system_u:object_r:container_file_t:s0:c438,c654) /home/zihad/Downloads/ventoy-1.1.07/Ventoy2Disk.ini: operation not permitted

Describe the results you expected

Describe the results you expected:
It should have mount the directory.

podman info output

podman version 5.6.1

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

Additional environment details

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

[Honny1]

@tazihad After the failure, could you please list the contents of the download directory with their SELinux labels (using ls -laZ)? I suspect that the extracted files have different labels and owners.

[github-actions]

A reviewer has determined we need more information to understand the reported issue. A comment on what is missing should be provided. Be certain you:

• provide an exact reproducer where possible
• verify you have provided all relevant information - minimum is podman info
• answer any follow up questions

If no response to the needs-info is provided in 30 days, this issue may be closed by our stale bot.

For more information on reporting issues on this repository, consult our issue guide.

[tazihad]

@Honny1
~/Downloads

❯ ls -laZ
total 42252
drwxr-xr-x. 1 zihad zihad system_u:object_r:container_file_t:s0:c215,c902          178 Oct  1 00:34  .
drwx------. 1 zihad zihad unconfined_u:object_r:user_home_dir_t:s0                 620 Oct  1 00:35  ..
-rw-r--r--. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902 23197305 Sep 30 11:46 'Hasan Bitmez Project - Ceddin Deden.flac'
-rw-r--r--. 1 zihad zihad system_u:object_r:container_file_t:s0:c215,c902         9957 Sep 29 08:45  images.jpg
drwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902      390 Oct  1 00:34  ventoy-1.1.07
-rw-r--r--. 1 zihad zihad system_u:object_r:container_file_t:s0:c211,c737     20053578 Sep 26 19:56  ventoy-1.1.07-linux.tar.gz

~/Downloads/ventoy-1.1.07

❯ ls -laZ
total 200
drwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902   434 Oct  1 00:37 .
drwxr-xr-x. 1 zihad zihad system_u:object_r:container_file_t:s0:c215,c902       178 Oct  1 00:34 ..
drwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902    38 Oct  1 00:34 boot
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902  3111 Aug 18 21:13 CreatePersistentImg.sh
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902  3022 Aug 18 21:13 ExtendPersistentImg.sh
-rw-r--r--. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902 10157 Oct  1 00:37 log.txt
drwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902    12 Oct  1 00:34 plugin
-rw-r--r--. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902  2558 Aug 18 21:13 README
drwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902   298 Oct  1 00:34 tool
drwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902    92 Oct  1 00:34 ventoy
-rw-r--r--. 1 root  root  unconfined_u:object_r:container_file_t:s0:c215,c902    64 Oct  1 00:37 Ventoy2Disk.ini
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902  1778 Aug 18 21:13 Ventoy2Disk.sh
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902 38456 Aug 18 21:13 VentoyGUI.aarch64
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902 30592 Aug 18 21:13 VentoyGUI.i386
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902 42944 Aug 18 21:13 VentoyGUI.mips64el
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902 32704 Aug 18 21:13 VentoyGUI.x86_64
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902  5389 Aug 18 21:13 VentoyPlugson.sh
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902  7064 Aug 18 21:13 VentoyVlnk.sh
-rwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902  2971 Aug 18 21:13 VentoyWeb.sh
drwxr-xr-x. 1 zihad zihad unconfined_u:object_r:container_file_t:s0:c215,c902    54 Oct  1 00:34 WebUI

[Honny1]

Thanks, I was able to reproduce the issue. The problem is that the owner of the file Ventoy2Disk.ini is root. Without root permission, rootless Podman cannot relabel files that are owned by another user, so SELinux is working as expected.

On your end, you can either change the ownership of the file (but the app would have a problem with that) or avoid mounting files that are owned by another user. From the Podman side, we can only improve the error message to be more clear that the file could not be relabeled because it is owned by someone else.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.