On Thu, Mar 24, 2022 at 1:01 PM Petr Lautrbach <plautrba@xxxxxxxxxx> wrote: > In some circumstances, like semanage-store being on overlayfs, rename() > could fail with EXDEV - Invalid cross-device link. This is due to the > fact that overlays doesn't support rename() if source and target are not > on the same layer, e.g. in containers built from several layers. Even > though it's not atomic operation, it's better to try to copy files from > src to dst on our own in this case. Next rebuild will probably not fail > as the new directories will be on the same layer. > > Fixes: https://github.com/SELinuxProject/selinux/issues/343 > > Reproducer: > > $ cd selinux1 > > $ cat Dockerfile > FROM fedora:35 > RUN dnf install -y selinux-policy selinux-policy-targeted > > $ podman build -t localhost/selinux . --no-cache > > $ cd ../selinux2 > > $ cat Dockerfile > FROM localhost/selinux > RUN semodule -B > > $ podman build -t localhost/selinux2 . --no-cache > STEP 2/2: RUN semodule -B > libsemanage.semanage_commit_sandbox: Error while renaming /var/lib/selinux/targeted/active to /var/lib/selinux/targeted/previous. (Invalid cross-device link). > semodule: Failed! > Error: error building at STEP "RUN semodule -B": error while running runtime: exit status 1 > > With the fix: > > $ podman build -t localhost/selinux2 . --no-cache > STEP 2/2: RUN semodule -B > libsemanage.semanage_rename: Warning: rename(/var/lib/selinux/targeted/active, /var/lib/selinux/targeted/previous) failed: Invalid cross-device link, fall back to non-atomic semanage_copy_dir_flags() > > COMMIT localhost/selinux2 > --> d2cfcebc1a1 > Successfully tagged localhost/selinux2:latest > d2cfcebc1a1b34f1c2cd661ac18292b0612c3e5fa71d6fa1441be244da91b1af > > Reported-by: Joseph Marrero Corchado <jmarrero@xxxxxxxxxx> > Signed-off-by: Petr Lautrbach <plautrba@xxxxxxxxxx> > --- > > v2 > - improve the commit message > - use WARN() instead of fprintf(stderr, > > v3 > - WARN without \n at the end > - split long line Acked-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx> Note that I didn't give the logic a thorough review, so I'd prefer someone else to give it a final look and merge it. -- Ondrej Mosnacek Software Engineer, Linux Security - SELinux kernel Red Hat, Inc.
