Containers fails on RHEL 9 due to Selinux preventing access

[varad-ahirwadkar]

On RHEL 9 getting error due to crun:

# crun --version
crun: symbol lookup error: crun: undefined symbol: criu_feature_check 

Updated to RHEL 9.1:

# podman version
Client:       Podman Engine
Version:      4.2.0
API Version:  4.2.0
Go Version:   go1.18.9
Built:        Tue Feb  7 05:59:03 2023
OS/Arch:      linux/ppc64le

# crun --version
crun version 1.5
commit: 54ebb8ca8bf7e6ddae2eb919f5b82d1d96863dea
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL

Try running busybox container:

podman run -it busybox echo "hello"

journalctl logs:

Mar 05 12:11:10 ocp4alll598.pok.stglabs.ibm.com setroubleshoot[38484]: failed to retrieve rpm info for /dev/pts/0
Mar 05 12:11:10 ocp4alll598.pok.stglabs.ibm.com systemd[1]: Started dbus-:1.1-org.fedoraproject.SetroubleshootPrivileged@1.service.
Mar 05 12:11:11 ocp4alll598.pok.stglabs.ibm.com systemd[1]: var-lib-containers-storage-overlay-57a050bb1b2023605dbf507a64b58409469fca09b8c2ae800da3febcca0c307d-merged.mount: Deactivated successfully.
Mar 05 12:11:11 ocp4alll598.pok.stglabs.ibm.com systemd[1]: var-lib-containers-storage-overlay.mount: Deactivated successfully.
Mar 05 12:11:11 ocp4alll598.pok.stglabs.ibm.com multipathd[30330]: tick (1.000351 secs)
Mar 05 12:11:11 ocp4alll598.pok.stglabs.ibm.com setroubleshoot[38484]: SELinux is preventing /bin/echo from 'read, write' accesses on the chr_file /dev/pts/0. For complete SELinux messages run: sealert -l f0210b69-e0d8-45b1-b2cf-f9a7b1899c99
Mar 05 12:11:11 ocp4alll598.pok.stglabs.ibm.com setroubleshoot[38484]: SELinux is preventing /bin/echo from 'read, write' accesses on the chr_file /dev/pts/0.

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

# yum info selinux-policy-targeted
Failed to set locale, defaulting to C.UTF-8
Updating Subscription Management repositories.
Last metadata expiration check: 2:54:57 ago on Tue Mar  7 04:25:53 2023.
Installed Packages
Name         : selinux-policy-targeted
Version      : 34.1.43
Release      : 1.el9_1.2
Architecture : noarch
Size         : 18 M
Source       : selinux-policy-34.1.43-1.el9_1.2.src.rpm
Repository   : @System
From repo    : rhel-9-for-ppc64le-baseos-rpms
Summary      : SELinux targeted policy
URL          : https://github.com/fedora-selinux/selinux-policy
License      : GPLv2+
Description  : SELinux targeted policy package.

[varad-ahirwadkar]

This issue not seen on latest RHEL

[varad-ahirwadkar]

closing this issue.