Fedora 31 Server, podman and SELinux



  • I'm guessing the only way to do it with Podman is to build the Dockerfile and then most likely use Podman to make a pod of the containers you want to run.



  • Don't need to run Docker. I do not run Docker but the Docker to Podman alias package needs to install

    dnf install podman-docker 
    

    With that installed, the script will find "Docker".



  • My apologies. I gave you the wrong SELinux label. The correct type is container_file_t. So run chcon -t container_file_t dir_name` and it should be the correct context.



  • No problem ๐Ÿ™‚ Anyway it does not work. Plenty of SELinux errors. I'll stop now with Podman and try to get working the cronjob commando without overwriting file permissions.

    I'm running in a VM so I can play around and crash ๐Ÿ˜ƒ

    Until I found a solution I'll issue the easyepg script manually on my Fedora Server host, just like I do today.



  • @Woti said in Fedora 31 Server, podman and SELinux:

    No problem ๐Ÿ™‚ Anyway it does not work. Plenty of SELinux errors. I'll stop now with Podman and try to get working the cronjob commando without overwriting file permissions.

    I'm running in a VM so I can play around and crash ๐Ÿ˜ƒ

    Until I found a solution I'll issue the easyepg script manually on my Fedora Server host, just like I do today.

    Weird. I was able to start the admin container with that SELinux label.



  • This post is deleted!


  • Finally I tried again. I removed all images and container and easyepg directory. I created a new directory in my /home/user/easyepg.
    At first I run your SELinux command as root user. After that as user I run the script and I could successfully run the images without any SELinux errors ๐Ÿ™‚

    That's nice ๐Ÿ™‚

    I found out there was an image missing: easyepg.cron
    In the script file https://raw.githubusercontent.com/dlueth/easyepg.minimal/master/init they use the flag --restart unless-stopped.

    sh -c "docker create -l easyepg.minimal --name=easyepg.cron -e MODE=\"cron\" --restart unless-stopped ${OPTIONS} qoopido/easyepg.minimal:${TAG} 1> /dev/null"
    

    This flag isn't supported by Podman.
    I guess Podman won't start easyepg.cron after server restart?
    Is there any solution?

    I downloaded the script with wget and made it executable. I removed the flag --reload unless-stopped and it worked.
    As it said, now I could convert the script to Portman and is there any way to get the SELinux label to work after reboot of the server?

    Thanks a lot for your help so long @stacksofplates ๐Ÿ™‚



  • @Woti said in Fedora 31 Server, podman and SELinux:

    Finally I tried again. I removed all images and container and easyepg directory. I created a new directory in my /home/user/easyepg.
    At first I run your SELinux command as root user. After that as user I run the script and I could successfully run the images without any SELinux errors ๐Ÿ™‚

    That's nice ๐Ÿ™‚

    I found out there was an image missing: easyepg.cron
    In the script file https://raw.githubusercontent.com/dlueth/easyepg.minimal/master/init they use the flag --restart unless-stopped.

    sh -c "docker create -l easyepg.minimal --name=easyepg.cron -e MODE=\"cron\" --restart unless-stopped ${OPTIONS} qoopido/easyepg.minimal:${TAG} 1> /dev/null"
    

    This flag isn't supported by Podman.
    I guess Podman won't start easyepg.cron after server restart?
    Is there any solution?

    I downloaded the script with wget and made it executable. I removed the flag --reload unless-stopped and it worked.
    As it said, now I could convert the script to Portman and is there any way to get the SELinux label to work after reboot of the server?

    Thanks a lot for your help so long @stacksofplates ๐Ÿ™‚

    No prob. That flag doesn't work because podman isn't a daemon. You can just create a systemd unit to start it and keep it running.

    The SELinux label will still be there after a reboot. It's "temporary" but that only means it will change on a relabel of the filesystem or a restorecon command.



  • Semanage will permanently change the context. I'll get the exact command when I'm done driving.



  • Sorry it took so long. It's semanage fcontext -a -t container_file_t <your-directory>.

    To do it recursively it's: semanage fcontext -a -t container_file_t "<your-directory>(/.*)?"



  • No stress sir ๐Ÿ™‚ Thanks for the command. I'll try it later.



  • @stacksofplates your semanage commands are working fine ๐Ÿ™‚



  • Hello again ๐Ÿ™‚
    I have now created a systemd service for podman easyepg by following this tutorial:
    https://www.redhat.com/sysadmin/podman-shareable-systemd-services
    and it looks like it works.
    Is there any way I can test if updating of epg channel informasjon is working as expected by triggering manuelly? The cronjob executes 2 a.m.

    After reboot the service is loaded but inactive. I have to activate manually? How can I figure out what's going wrong during boot?

    podman generate systemd --name easyepg.cron 
    
    # container-easyepg.cron.service
    # autogenerated by Podman 1.8.0
    # Mon Mar 16 22:40:13 CET 2020
    
    [Unit]
    Description=Podman container-easyepg.cron.service
    Documentation=man:podman-generate-systemd(1)
    
    [Service]
    Restart=on-failure
    ExecStart=/usr/bin/podman start easyepg.cron
    ExecStop=/usr/bin/podman stop -t 10 easyepg.cron
    PIDFile=/run/user/1000/containers/overlay-containers/a5482f12e8b718d6d080eb0a10283b456e58f57c2f1bd22c64e49f9e91073da8/userdata/conmon.pid
    KillMode=none
    Type=forking
    
    [Install]
    WantedBy=multi-user.target
    
    systemctl --user status container-easyepg.service
    
    โ— container-easyepg.service - Podman container-easyepg.cron.service
       Loaded: loaded (/home/twolf/.config/systemd/user/container-easyepg.service; disabled; vendor preset: enabled)
       Active: active (running) since Tue 2020-03-17 21:30:35 CET; 1s ago
         Docs: man:podman-generate-systemd(1)
      Process: 1405 ExecStart=/usr/bin/podman start easyepg.cron (code=exited, status=0/SUCCESS)
     Main PID: 1429 (conmon)
        Tasks: 4 (limit: 2333)
       Memory: 23.0M
          CPU: 1.092s
       CGroup: /user.slice/user-1000.slice/[email protected]/container-easyepg.service
               โ”œโ”€1420 /usr/bin/fuse-overlayfs -o lowerdir=/home/twolf/.local/share/containers/storage/overlay/l/2YMPIRCLJIU>           โ”œโ”€1423 /usr/bin/slirp4netns --disable-host-loopback --mtu 65520 -c -e 3 -r 4 --netns-type=path /run/user/100>           โ””โ”€1429 /usr/bin/conmon --api-version 1 -s -c a5482f12e8b718d6d080eb0a10283b456e58f57c2f1bd22c64e49f9e91073da>
    Mรคr 17 21:30:33 localhost.localdomain systemd[981]: Starting Podman container-easyepg.cron.service...
    Mรคr 17 21:30:35 localhost.localdomain podman[1405]: 2020-03-17 21:30:35.237845063 +0100 CET m=+1.249145219 container in>Mรคr 17 21:30:35 localhost.localdomain podman[1405]: 2020-03-17 21:30:35.287066083 +0100 CET m=+1.298366135 container st>Mรคr 17 21:30:35 localhost.localdomain podman[1405]: easyepg.cron
    Mรคr 17 21:30:35 localhost.localdomain systemd[981]: Started Podman container-easyepg.cron.service.
    
    podman ps
    
    CONTAINER ID  IMAGE                                     COMMAND  CREATED     STATUS             PORTS  NAMES
    a5482f12e8b7  docker.io/qoopido/easyepg.minimal:latest           6 days ago  Up 12 minutes ago         easyepg.cron
    
    


  • If it's really using cron, I don't know of a way to make it test without letting that happen.

    As for the other issue, I've had that as well and I don't know a way around it. I'm still trying to figure that out. I run plex in a container and every time the host reboots I have to restart it.



  • As for now the server is rebooting once or twice in a month due updates. There's no big problem to start the service manually. Maybe one day we figure out why it isn't starting automatically.

    Anyway. Thanx for your effort to get rid of the SElinux problem. ๐Ÿ™‚



  • So I got a container to start with the system. I don't like what podman generate systemd gives you because it defeats the purpose of a container. Here's what I have:

    [Unit]
    Description=Plex
    After=network.target
    
    [Service]
    TimeoutStartSec=5m
    Restart=always
    ExecStartPre=-/usr/bin/podman rm -f plex
    ExecStart=podman run --name plex -v /mnt/media/movies:/movies -v /mnt/media/tv:/tv -v /mnt/media/music:/music -v /home/jhooks/plex/config:/config -p 32400:32400 -p 32400:32400/udp -p 32469:32469 -p 32469:32469/udp -p 5353:5353/udp -p 1900:1900/udp linuxserver/plex
    ExecStop=-/usr/bin/podman kill plex
    Type=simple
    User=jhooks
    RestartSec=30
    
    [Install]
    WantedBy=multi-user.target
    

    I was running ExecStart=podman run -d --rm --name plex blah blah but even when I used forking it was failing to track the process.

    This will kill the container and spin up a new one for me each time which is what I wanted. That way I'm not dependent on container IDs existing.


Log in to reply