manifest/raw_bootc: Label / and /boot before running bootc install by jbtrystram · Pull Request #2525 · osbuild/image-builder

jbtrystram · 2026-07-15T13:34:12Z

When SELinux is enabled, insert a few stages before running bootc install that will make sure the root and boot mount points are labelled. This avoid files under /sysroot created by bootc to be unlabeled_t and this makes sure files under /boot created by bootupd inherit the correct boot_t label.

See #2494
Assisted-by: Opencode.ai <Opus 4.6>

brlane-rht · 2026-07-15T20:50:09Z

Which image types are you seeing a problem with? Please provide a reproducer if possible. Also, have you tested this? I gave it a quick try and it blows up in your new mkdir stage because mounts already create the mountpoint, not need to do it manually.

jbtrystram · 2026-07-16T13:50:16Z

@brlane-rht thanks for the review ! I fixed the PR. The mkdir stage is still here because we want to label the mountpoint without anything mounted. So when further files are created in the mounted FS, they inherit the correct SELinux label from the mountpoint.

I am building fedora CoreOS using blueprints defined here : https://github.com/joelcapitao/bib-fcos-experimentation/

So for a QEMU image for x86 I have the following blueprint :

name = "Fedora CoreOS"

[customizations.ignition.firstboot]
empty = true

[customizations.kernel]
append = "mitigations=auto,nosmt $ignition_firstboot ignition.platform.id=qemu console=tty0 console=ttyS0,115200n8"

I am building the image with :

TARGET_FCOS_IMAGE=quay.io/fedora/fedora-coreos:rawhide
BUILDER=quay.io/bootc-devel/fedora-bootc-rawhide-standard

sudo podman run --rm --privileged \
           --network=none \
           -v /var/lib/containers/storage:/var/lib/containers/storage \
           -v ./output:/output \
           -v .:/srv \
           quay.io/jbtrystramtestimages/ib-cli:pr-selinux-labels build qcow2 \
             --bootc-build-ref $BUILDER \
             --bootc-ref $TARGET_FCOS_IMAGE \
             --output-dir fedora-coreos \
             --output-name fedora-coreos-rawhide \
             --with-buildlog \
             --with-manifest \
             --with-metrics \
             --blueprint /srv/blueprints/generated/qemu-x86_64.toml

With this PR, the resulting labels are corrects :

cosa run --qemu-image output/fedora-coreos/fedora-coreos-rawhide.qcow2 -x 'ls -lZ /sysroot'                                                          

drwxr-xr-x. 2 root root system_u:object_r:boot_t:s0  6 Jul 16 13:39 boot
drwxr-xr-x. 6 root root system_u:object_r:usr_t:s0  75 Jul 16 13:43 ostree

# And /boot : 
lrwxrwxrwx. 1 root root unconfined_u:object_r:boot_t:s0       1 Jul 16 13:39 boot -> .
-rw-r--r--. 1 root root unconfined_u:object_r:boot_t:s0    2154 Jul 16 13:39 bootupd-state.json
drwxr-xr-x. 2 root root system_u:object_r:boot_t:s0        1024 Jul 16 13:39 efi
drwxr-xr-x. 5 root root unconfined_u:object_r:boot_t:s0    1024 Jul 16 13:48 grub2
lrwxrwxrwx. 1 root root unconfined_u:object_r:boot_t:s0       8 Jul 16 13:39 loader -> loader.1
drwxr-xr-x. 3 root root unconfined_u:object_r:boot_t:s0    1024 Jul 16 13:39 loader.1
drwx------. 2 root root system_u:object_r:lost_found_t:s0 12288 Jul 16 13:39 lost+found
drwxr-xr-x. 3 root root unconfined_u:object_r:boot_t:s0    1024 Jul 16 13:39 ostree

Here is the generated manifest : fedora-coreos-rawhide.osbuild-manifest.json

See #2494

When SELinux is enabled, insert a few stages before running `bootc install` that will make sure the `root` and `boot` mount points are labelled. This avoid files under `/sysroot` created by bootc to be `unlabeled_t` and this makes sure files under `/boot` created by bootupd inherit the correct `boot_t` label. See osbuild#2494 Assisted-by: Opencode.ai <Opus 4.6>

supakeen · 2026-07-23T14:21:31Z

@brlane-rht since you drafted this I don't want to undraft it without you being involved. Is this OK to review?

brlane-rht · 2026-07-23T23:23:47Z

@brlane-rht since you drafted this I don't want to undraft it without you being involved. Is this OK to review?

If @jbtrystram thinks it is ready. I drafted it because it looked like it was completely untested. I'm still not sure about it changing this for everything using RawBootcImage -- I don't see a problem with the labels in bootc-pxe-tar for example.

jbtrystram · 2026-07-24T07:11:11Z

@brlane-rht since you drafted this I don't want to undraft it without you being involved. Is this OK to review?

If @jbtrystram thinks it is ready. I drafted it because it looked like it was completely untested.

It's ready, i updated and tested it since.

I'm still not sure about it changing this for everything using RawBootcImage -- I don't see a problem with the labels in bootc-pxe-tar for example.

The resulting image do not change much except for files in the ostree repo and /boot

supakeen

This is OK but it does codify a bit more the expectations we have around /boot, /boot/efi, and such. Not a problem in the current bootc situation but if we move onto things like systemd-gpt-auto-generator and such this will likely need a rework.

jbtrystram · 2026-07-28T06:20:39Z

This is OK but it does codify a bit more the expectations we have around /boot, /boot/efi, and such. Not a problem in the current bootc situation but if we move onto things like systemd-gpt-auto-generator and such this will likely need a rework.

mhmm you are right that this might fail in the composefs + systemd-boot path where there is no separate /boot partition. I did not test with such an image

supakeen · 2026-07-28T06:44:05Z

This is OK but it does codify a bit more the expectations we have around /boot, /boot/efi, and such. Not a problem in the current bootc situation but if we move onto things like systemd-gpt-auto-generator and such this will likely need a rework.

mhmm you are right that this might fail in the composefs + systemd-boot path where there is no separate /boot partition. I did not test with such an image

And maybe even more generally in the native composefs path where there is (if I recall) no /sysroot at all?

Perhaps we should test such an image; you can use one from https://github.com/travier/fedora-atomic-desktops-sealed specifically the bootc one which doesn't feature a full desktop environment. You might need travier/fedora-atomic-desktops-sealed#38

I'll retract my ack until we have done so.

supakeen

Let's test with a sealed image.

jbtrystram · 2026-07-28T12:54:11Z

I tried with a container image built with the PR @supakeen linked above, and it s failing during bootc install :

	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632
 
Allocating group tables:  0/64�����     �����done                            
Writing inode tables:  0/64�����     �����done                            
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information:  0/64�����     �����done
 
 
⏱  Duration: 1.24s
org.osbuild.mkdir: 79ab1954e518171ad2b47946a1f58c7e38181cf84d5269398bff197d0919ee09 {
  "paths": [
    {
      "path": "mount://-/boot",
      "mode": 493
    }
  ]
}
device/disk (org.osbuild.loopback): loop0 acquired (locked: False)
mount/- (org.osbuild.ext4): mounting /dev/loop0p2 -> /var/cache/image-builder/store/tmp/buildroot-tmp-47uvmxj1/mounts/
mount/- (org.osbuild.ext4): umount: /var/cache/image-builder/store/tmp/buildroot-tmp-47uvmxj1/mounts/ unmounted
 
⏱  Duration: 1.46s
org.osbuild.selinux: 7405a09c77716b38614ac01579fbae65fc4a205decb0c9d5081f3a4f7a4265b1 {
  "target": "mount://-/",
  "file_contexts": "input://tree/etc/selinux/targeted/contexts/files/file_contexts"
}
device/disk (org.osbuild.loopback): loop0 acquired (locked: False)
mount/- (org.osbuild.ext4): mounting /dev/loop0p2 -> /var/cache/image-builder/store/tmp/buildroot-tmp-3nmiuil_/mounts/
mount/- (org.osbuild.ext4): umount: /var/cache/image-builder/store/tmp/buildroot-tmp-3nmiuil_/mounts/ unmounted
 
⏱  Duration: 1.84s
org.osbuild.bootc.install-to-filesystem: a33c0da221e8e4e883b11bd75d3d0a72bdd1d36b0658c7fafb98ee0afa698318 {
  "target-imgref": "quay.io/jbtrystramtestimages/misc:sealed-bootc",
  "bootloader": "systemd",
  "composefs": true
}
device/disk (org.osbuild.loopback): loop0 acquired (locked: False)
mount/- (org.osbuild.ext4): mounting /dev/loop0p2 -> /var/cache/image-builder/store/tmp/buildroot-tmp-bsbs_xbu/mounts/
mount/boot-efi (org.osbuild.fat): mounting /dev/loop0p1 -> /var/cache/image-builder/store/tmp/buildroot-tmp-bsbs_xbu/mounts/boot/efi
Installing image: docker://quay.io/jbtrystramtestimages/misc:sealed-bootc
Bootloader: systemd
Installing bootloader via systemd-boot
error: Installing to filesystem: Setting up composefs boot: Setting up UKI boot: Writing 7.1.5-200.fc44.x86_64.efi to ESP: The UKI has the wrong composefs= parameter (is 'sha512:9f815032e02f5853b38902002ef04adcf39c55a29dddfebdebe56d7e123cc8acd98242cdc248b1dae2fa6450ccbf41f6b897166f673bf08a0b51687ec42c0837', should be sha512:b3bc26f93753366d0624b89dd94e6d998cc389a7e81e417da3cb03040f1e4684347b80e5e8010bea280bc0f393c5cd5b700e010992b6ab87e35c5ada84d45a4e)
Traceback (most recent call last):
  File "/run/osbuild/bin/org.osbuild.bootc.install-to-filesystem", line 92, in <module>
    r = main(args["options"], args["inputs"], args["paths"])
  File "/run/osbuild/bin/org.osbuild.bootc.install-to-filesystem", line 84, in main
    subprocess.run(pargs, env=env, check=True)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.15/subprocess.py", line 692, in run
    raise CalledProcessError(retcode, process.args,
                             output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['bootc', 'install', 'to-filesystem', '--source-imgref', 'containers-storage:[overlay@/run/osbuild/containers/storage2+/run/containers/storage:additionalimagestore=/run/osbuild/containers/storage]1fc950766675141a5e9919fb2bbc3a54eb86baec2498f5452f40be3fc68f5bd1', '--skip-fetch-check', '--generic-image', '--target-imgref', 'quay.io/jbtrystramtestimages/misc:sealed-bootc', '--bootloader', 'systemd', '--composefs-backend', '/run/osbuild/mounts']' returned non-zero exit status 1.
mount/boot-efi (org.osbuild.fat): umount: /var/cache/image-builder/store/tmp/buildroot-tmp-bsbs_xbu/mounts/boot/efi unmounted
mount/- (org.osbuild.ext4): umount: /var/cache/image-builder/store/tmp/buildroot-tmp-bsbs_xbu/mounts/ unmounted
 
⏱  Duration: 95.61s
manifest - failed
Failed
error: error running osbuild: exit status 1
ERROR: Failed to build qemu

That said, I am not entirely sure the failure is due to this change.

supakeen · 2026-07-28T13:09:21Z

I tried with a container image built with the PR @supakeen linked above, and it s failing during bootc install :

	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632
 
Allocating group tables:  0/64�����     �����done                            
Writing inode tables:  0/64�����     �����done                            
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information:  0/64�����     �����done
 
 
⏱  Duration: 1.24s
org.osbuild.mkdir: 79ab1954e518171ad2b47946a1f58c7e38181cf84d5269398bff197d0919ee09 {
  "paths": [
    {
      "path": "mount://-/boot",
      "mode": 493
    }
  ]
}
device/disk (org.osbuild.loopback): loop0 acquired (locked: False)
mount/- (org.osbuild.ext4): mounting /dev/loop0p2 -> /var/cache/image-builder/store/tmp/buildroot-tmp-47uvmxj1/mounts/
mount/- (org.osbuild.ext4): umount: /var/cache/image-builder/store/tmp/buildroot-tmp-47uvmxj1/mounts/ unmounted
 
⏱  Duration: 1.46s
org.osbuild.selinux: 7405a09c77716b38614ac01579fbae65fc4a205decb0c9d5081f3a4f7a4265b1 {
  "target": "mount://-/",
  "file_contexts": "input://tree/etc/selinux/targeted/contexts/files/file_contexts"
}
device/disk (org.osbuild.loopback): loop0 acquired (locked: False)
mount/- (org.osbuild.ext4): mounting /dev/loop0p2 -> /var/cache/image-builder/store/tmp/buildroot-tmp-3nmiuil_/mounts/
mount/- (org.osbuild.ext4): umount: /var/cache/image-builder/store/tmp/buildroot-tmp-3nmiuil_/mounts/ unmounted
 
⏱  Duration: 1.84s
org.osbuild.bootc.install-to-filesystem: a33c0da221e8e4e883b11bd75d3d0a72bdd1d36b0658c7fafb98ee0afa698318 {
  "target-imgref": "quay.io/jbtrystramtestimages/misc:sealed-bootc",
  "bootloader": "systemd",
  "composefs": true
}
device/disk (org.osbuild.loopback): loop0 acquired (locked: False)
mount/- (org.osbuild.ext4): mounting /dev/loop0p2 -> /var/cache/image-builder/store/tmp/buildroot-tmp-bsbs_xbu/mounts/
mount/boot-efi (org.osbuild.fat): mounting /dev/loop0p1 -> /var/cache/image-builder/store/tmp/buildroot-tmp-bsbs_xbu/mounts/boot/efi
Installing image: docker://quay.io/jbtrystramtestimages/misc:sealed-bootc
Bootloader: systemd
Installing bootloader via systemd-boot
error: Installing to filesystem: Setting up composefs boot: Setting up UKI boot: Writing 7.1.5-200.fc44.x86_64.efi to ESP: The UKI has the wrong composefs= parameter (is 'sha512:9f815032e02f5853b38902002ef04adcf39c55a29dddfebdebe56d7e123cc8acd98242cdc248b1dae2fa6450ccbf41f6b897166f673bf08a0b51687ec42c0837', should be sha512:b3bc26f93753366d0624b89dd94e6d998cc389a7e81e417da3cb03040f1e4684347b80e5e8010bea280bc0f393c5cd5b700e010992b6ab87e35c5ada84d45a4e)
Traceback (most recent call last):
  File "/run/osbuild/bin/org.osbuild.bootc.install-to-filesystem", line 92, in <module>
    r = main(args["options"], args["inputs"], args["paths"])
  File "/run/osbuild/bin/org.osbuild.bootc.install-to-filesystem", line 84, in main
    subprocess.run(pargs, env=env, check=True)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.15/subprocess.py", line 692, in run
    raise CalledProcessError(retcode, process.args,
                             output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['bootc', 'install', 'to-filesystem', '--source-imgref', 'containers-storage:[overlay@/run/osbuild/containers/storage2+/run/containers/storage:additionalimagestore=/run/osbuild/containers/storage]1fc950766675141a5e9919fb2bbc3a54eb86baec2498f5452f40be3fc68f5bd1', '--skip-fetch-check', '--generic-image', '--target-imgref', 'quay.io/jbtrystramtestimages/misc:sealed-bootc', '--bootloader', 'systemd', '--composefs-backend', '/run/osbuild/mounts']' returned non-zero exit status 1.
mount/boot-efi (org.osbuild.fat): umount: /var/cache/image-builder/store/tmp/buildroot-tmp-bsbs_xbu/mounts/boot/efi unmounted
mount/- (org.osbuild.ext4): umount: /var/cache/image-builder/store/tmp/buildroot-tmp-bsbs_xbu/mounts/ unmounted
 
⏱  Duration: 95.61s
manifest - failed
Failed
error: error running osbuild: exit status 1
ERROR: Failed to build qemu

That said, I am not entirely sure the failure is due to this change.

Sadly it is not, bootc has shipped various fixes to this over the 1.16.4 and 1.16.5 releases and 1.16.5 only made it into rawhide today; it's probably not yet in that container 🙁

jbtrystram · 2026-07-29T15:13:55Z

Also @alexlarsson might want to have a look at this :)

jbtrystram requested a review from a team as a code owner July 15, 2026 13:34

jbtrystram requested review from brlane-rht, croissanne and supakeen July 15, 2026 13:34

jbtrystram mentioned this pull request Jul 15, 2026

QEMU Failing tests joelcapitao/bib-fcos-experimentation#7

Open

3 tasks

brlane-rht force-pushed the selinux-label-before-bootc branch from b4cc44b to d564632 Compare July 15, 2026 18:29

brlane-rht marked this pull request as draft July 15, 2026 20:50

jbtrystram force-pushed the selinux-label-before-bootc branch from d564632 to cce1e23 Compare July 16, 2026 13:43

jbtrystram force-pushed the selinux-label-before-bootc branch from cce1e23 to f8614fa Compare July 16, 2026 13:50

jbtrystram force-pushed the selinux-label-before-bootc branch from f8614fa to 1335b47 Compare July 23, 2026 13:20

jbtrystram marked this pull request as ready for review July 24, 2026 08:03

supakeen approved these changes Jul 28, 2026

View reviewed changes

supakeen requested changes Jul 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

manifest/raw_bootc: Label / and /boot before running bootc install - #2525

manifest/raw_bootc: Label / and /boot before running bootc install#2525
jbtrystram wants to merge 1 commit into
osbuild:mainfrom
jbtrystram:selinux-label-before-bootc

jbtrystram commented Jul 15, 2026

Uh oh!

brlane-rht commented Jul 15, 2026

Uh oh!

jbtrystram commented Jul 16, 2026 •

edited

Loading

Uh oh!

supakeen commented Jul 23, 2026

Uh oh!

brlane-rht commented Jul 23, 2026

Uh oh!

jbtrystram commented Jul 24, 2026

Uh oh!

supakeen left a comment

Uh oh!

jbtrystram commented Jul 28, 2026

Uh oh!

supakeen commented Jul 28, 2026 •

edited

Loading

Uh oh!

supakeen left a comment

Uh oh!

jbtrystram commented Jul 28, 2026

Uh oh!

supakeen commented Jul 28, 2026

Uh oh!

jbtrystram commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jbtrystram commented Jul 15, 2026

Uh oh!

brlane-rht commented Jul 15, 2026

Uh oh!

jbtrystram commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

supakeen commented Jul 23, 2026

Uh oh!

brlane-rht commented Jul 23, 2026

Uh oh!

jbtrystram commented Jul 24, 2026

Uh oh!

supakeen left a comment

Choose a reason for hiding this comment

Uh oh!

jbtrystram commented Jul 28, 2026

Uh oh!

supakeen commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

supakeen left a comment

Choose a reason for hiding this comment

Uh oh!

jbtrystram commented Jul 28, 2026

Uh oh!

supakeen commented Jul 28, 2026

Uh oh!

jbtrystram commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jbtrystram commented Jul 16, 2026 •

edited

Loading

supakeen commented Jul 28, 2026 •

edited

Loading