SUSE Multi Linux Manager (MLM) Container File Permission Issues upon restart due to SELinux Context

SUSE Multi Linux Manager 5.0

A user is unable to move files within an SMLM container due to permission issues. The files trying to be accessed were initially saved in a non-persistent storage location such as “/” and later moved to a persistent location like “/root”. After the container was restarted, the files could no longer be interacted with due to SELinux context issues.  

To resolve SELinux categories context issue with container files, execute the following steps from the container host (the system hosting the container, not the container itself):

1. Locate the file in the persistent storage location.  This location should be under the path /var/lib/containers/storage/volumes/.

/var/lib/containers/storage/volumes/$PersistentLocation/_data/$file

For example:
/var/lib/containers/storage/volumes/root/_data/File_Saved_in_nonpersistant_originally

2. Once the file is found, update the values:

- Update the file context using the semanage fcontext command:

semanage fcontext -a -t container_file_t /var/lib/containers/storage/volumes/$PersistentLocation/_data/$file

- Reset the SELinux categories using the chcon command:

chcon -l s0 /var/lib/containers/storage/volumes/$PersistentLocation/_data/$file

- Apply the changes with the restorecon command:

restorecon -v /var/lib/containers/storage/volumes/$PersistentLocation/_data/$file

After completing these steps, the file should be accessible and movable within the container again.

SELinux context issues arise when files are created in non-persistent storage locations within a container, leading to permission denials after the container restarts due to regenerated SELinux categories. This is further compounded when moving files between non-persistent and persistent storage locations.

Listing with SELinux context one would see something like the following for the files that can not be interacted with:

uyuni-server:~ # ls -lhZ 
...
-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0:c654,c842 7.6K Jan 18 11:11 File_Saved_in_nonpersistant_originally
...

Notice the "c654,c842" in the listing for “File_Saved_in_nonpersistent_originally”, these are the SELinux categories for the container when the file was saved.

Below is what a file saved in a persistent location looks like, notice no categories are assigned.

uyuni-server:~ # ls -lhZ 
...
-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0            937 Jun 18 11:00 file_saved_in_persistant
...