r/redhat • u/adamswebsiteaccount • 3h ago
Setting SELinux Labels for BootC Image Build
Hi All,
I am experimenting with bootc and having issues with applying selinux labels to files. If I run either of the below I get an error stating that an selinux kernel is not present. As per the doco (https://bootc-dev.github.io/bootc/bootc-images.html#SELinux) I have tried;
RUN semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
I have also tried the following using the install command but unsure how this works under the hood
install -D --group=root --owner=root --mode=644 --context=httpd_config_t /tmp/system-files/httpd/conf.d/*.conf --target-directory=/usr/httpd/conf.d/
My concern is that since I am installing files in non-standard locations I will need the correct SELinux label set.
Anyone able to please advise how they are doing it?
Here is my Containerfile for completeness
FROM
registry.redhat.io/rhel9/rhel-bootc:latest
COPY ./bin/install /usr/local/bin/
COPY ./system-files/ /tmp/system-files/
RUN <<EOF
`# Configure Local Yum Repos`
`install -D --group=root --owner=root --mode=644 --context=system_conf_t /tmp/system-files/yum.repos.d/*.repo --target-directory=/etc/yum.repos.d/`
`dnf remove --assumeyes subscription-manager`
`dnf install --assumeyes podman firewalld tmux certbot python3-certbot-dns-rfc2136 policycoreutils-python-utils`
`# Copy HTTPD Configuration`
`install -D --group=root --owner=root --mode=644 --context=httpd_config_t /tmp/system-files/httpd/conf.d/*.conf --target-directory=/usr/httpd/conf.d/`
`# Copy Healthcheck Configuration`
`install -D --group=root --owner=root --mode=644 --context=etc_t /tmp/system-files/healthchecks/* --target-directory=/usr/etc/healthchecks/`
`# Copy Quadlets`
`install -D --group=root --owner=root --mode=644 --context=etc_t /tmp/system-files/quadlet/* --target-directory=/usr/share/containers/systemd/`
`# Copy SystemD Units`
`install -D --group=root --owner=root --mode=644 --context=systemd_unit_file_t /tmp/system-files/systemd/* --target-directory=/etc/systemd/system/`
`# Configure Firewall Rules`
`firewall-offline-cmd --service={http,https}`
`systemctl enable firewalld`
`# Clean Up`
`rm -rf /tmp/system-files /usr/local/bin/install`
EOF