podman on Mac host, third party repository scripts using :z/:Z

[ncdc]

@rhatdan following up from #13727 here to avoid any more noise on that issue 😄

I'm trying to run some make commands from the openshift/release repo, and they run pretty much everything in containers, and the bind mounts have :z. What do you think the best course of action should be?

1. Consumers (e.g. openshift/release) should look for a Mac host and skip :Z/:z in their scripts
2. podman should ignore :Z/:z if the host is Mac
3. Something else?

Thanks!

[rhatdan]

Well Option 2 is impossible, since SELinux would have no idea it is on a MAC.
The issue is Podman gets ENOTSUP on Relabel. We could change Podman to drop the relabel on that ERRNO, but that would be a big change. And since the Relabel is for security purposes, not something I would be in favor of.

How would openshift/release know it is on a MAC?

[rhatdan]

virtiofsd on a mac host with relabling in the VM would work.

[ncdc]

So on a Mac, podman run -v /a:/b:z would work in that case? I'm thinking about the user experience, where someone is doing something similar to me - I grabbed a 3rd party repo, tried to run one of its scripts, and it failed. I could ask the repo maintainers to fix it (or submit a PR), but then I might run into the same issue in some other 3rd party repo potentially. Would it be worthwhile to build support into the podman client to ignore :z/:Z when the host is a Mac?

[rhatdan]

I don't believe so. You told Podman to relabel content in these directories, it got an error saying "It is not supported" Podman on a MAC would not know if this is expected or not.

[ncdc]

So eventually a bind mounted volume coming from a Mac host with SELinux relabeling is something that will be supported (via virtiofsd)?

[rhatdan]

Yes.