Toolbox: 'enter' is broken when SELinux is disabled

[sebelk]

Hi,
When I run toolbox --verbose enter

it outputs:

toolbox: running as real user ID 1000
toolbox: resolved absolute path for /usr/bin/toolbox to /usr/bin/toolbox
toolbox: checking if /etc/subgid and /etc/subuid have entries for user sergio
toolbox: TOOLBOX_PATH is /usr/bin/toolbox
toolbox: running on a cgroups v2 host
toolbox: current Podman version is 1.6.2
toolbox: migration not needed: Podman version 1.6.2 is unchanged
toolbox: Fedora generational core is f31
toolbox: base image is fedora-toolbox:31
toolbox: container is fedora-toolbox-31
toolbox: checking if container fedora-toolbox-31 exists
toolbox: container fedora-toolbox-31 not found
toolbox: found 0 containers
No toolbox containers found. Create now? [y/N] y
toolbox: Fedora generational core is f31
toolbox: base image is fedora-toolbox:31
toolbox: container is fedora-toolbox-31
toolbox: checking value /run/.heim_org.h5l.kcm-socket (Stream) of property Listen in sssd-kcm.socket
toolbox: parsing value /run/.heim_org.h5l.kcm-socket (Stream) of property Listen in sssd-kcm.socket
toolbox: checking if 'podman create' supports --ulimit host
toolbox: 'podman create' supports --ulimit host
toolbox: looking for image localhost/fedora-toolbox:31
toolbox: looking for image registry.fedoraproject.org/f31/fedora-toolbox:31
Image required to create toolbox container.
Download registry.fedoraproject.org/f31/fedora-toolbox:31 (500MB)? [y/N]: y
toolbox: pulling image registry.fedoraproject.org/f31/fedora-toolbox:31
Trying to pull registry.fedoraproject.org/f31/fedora-toolbox:31...
Getting image source signatures
Copying blob a31161543ddc done
Copying blob 133418e148d9 done
Copying config a198bc8c3c done
Writing manifest to image destination
Storing signatures
toolbox: base image fedora-toolbox:31 resolved to registry.fedoraproject.org/f31/fedora-toolbox:31
toolbox: checking if container fedora-toolbox-31 already exists
toolbox: checking if /usr is mounted read-only or read-write
toolbox: mount-point of /usr is /
toolbox: mount flags of /usr on the host are rw,relatime
toolbox: /home/sergio canonicalized to /home/sergio
toolbox: checking if /home is a symbolic link to /var/home
toolbox: calling org.freedesktop.Flatpak.SessionHelper.RequestSession
toolbox: creating container fedora-toolbox-31
toolbox: calling org.freedesktop.Flatpak.SessionHelper.RequestSession
toolbox: starting container fedora-toolbox-31
toolbox: /etc/profile.d/toolbox.sh already mounted in container fedora-toolbox-31
toolbox: inspecting entry point of container fedora-toolbox-31
toolbox: entry point of container fedora-toolbox-31 is toolbox
toolbox: waiting for container fedora-toolbox-31 to finish initializing
toolbox: invalid entry point PID of container fedora-toolbox-31

My OS is Fedora 31 Workstation, with toolbox-0.0.17-1.fc31.noarch and podman-1.6.2-2.fc31.x86_64

Thanks in advance

[jeka]

I am having the same problem, but I can shed some light on the issue:

$ rpm -q toolbox
toolbox-0.0.17-1.fc31.noarch

$ sestatus
SELinux status:                 disabled



md5-2a8659cf91a2d4815ab4084a2237e087



$ podman ps -a
CONTAINER ID  IMAGE                                             COMMAND               CREATED         STATUS                     PORTS  NAMES
9b51130d58ff  registry.fedoraproject.org/f31/fedora-toolbox:31  toolbox --verbose...  16 minutes ago Exited (1) 16 minutes ago         fedora-toolbox-31



md5-2a8659cf91a2d4815ab4084a2237e087



$ podman logs 9b51130d58ff
toolbox: running as real user ID 0
toolbox: resolved absolute path for /usr/bin/toolbox to /usr/bin/toolbox
toolbox: TOOLBOX_PATH is /usr/bin/toolbox
toolbox: XDG_RUNTIME_DIR is unset
toolbox: XDG_RUNTIME_DIR set to /run/user/1000
toolbox: creating /run/.toolboxenv
toolbox: redirecting /etc/host.conf to /run/host/etc/host.conf
toolbox: redirecting /etc/hosts to /run/host/etc/hosts
toolbox: redirecting /etc/resolv.conf to /run/host/etc/resolv.conf
toolbox: binding /etc/machine-id to /run/host/etc/machine-id
toolbox: creating /run/libvirt
toolbox: binding /run/libvirt to /run/host/run/libvirt
toolbox: creating /run/systemd/journal
toolbox: binding /run/systemd/journal to /run/host/run/systemd/journal
toolbox: creating /sys/fs/selinux
mkdir: cannot create directory '/sys/fs/selinux': Permission denied
toolbox: failed to create /sys/fs/selinux

[torvitas]

I am having the same problem, but I can shed some light on the issue:

$ rpm -q toolbox
toolbox-0.0.17-1.fc31.noarch

$ sestatus
SELinux status:                 disabled

$ podman ps -a
CONTAINER ID  IMAGE                                             COMMAND               CREATED         STATUS                     PORTS  NAMES
9b51130d58ff  registry.fedoraproject.org/f31/fedora-toolbox:31  toolbox --verbose...  16 minutes ago Exited (1) 16 minutes ago         fedora-toolbox-31

$ podman logs 9b51130d58ff
toolbox: running as real user ID 0
toolbox: resolved absolute path for /usr/bin/toolbox to /usr/bin/toolbox
toolbox: TOOLBOX_PATH is /usr/bin/toolbox
toolbox: XDG_RUNTIME_DIR is unset
toolbox: XDG_RUNTIME_DIR set to /run/user/1000
toolbox: creating /run/.toolboxenv
toolbox: redirecting /etc/host.conf to /run/host/etc/host.conf
toolbox: redirecting /etc/hosts to /run/host/etc/hosts
toolbox: redirecting /etc/resolv.conf to /run/host/etc/resolv.conf
toolbox: binding /etc/machine-id to /run/host/etc/machine-id
toolbox: creating /run/libvirt
toolbox: binding /run/libvirt to /run/host/run/libvirt
toolbox: creating /run/systemd/journal
toolbox: binding /run/systemd/journal to /run/host/run/systemd/journal
toolbox: creating /sys/fs/selinux
mkdir: cannot create directory '/sys/fs/selinux': Permission denied
toolbox: failed to create /sys/fs/selinux

Exactly the same here.

[HarryMichal]

That's weird. I just fired up a VM with Fedora Workstation 31, upgraded to the latest, installed Toolbox and successfully managed to create and enter a container after running toolbox enter.

EDIT: Now that I think about it, the difference is that you have SELinux disabled, while I have it enabled. I'll check the behaviour after disabling it. Why did you disable it??

[jeka]

with SELinux enabled, it works
But not when SELinux is disabled.

Well I am doing all sorts of weird stuff on my wks (research), and I don't want to fight with SELinux

[sebelk]

I can confirm that with SELinux enabled toolbox works.

[Rafostar]

This bug affects not only workstation. I have the exact same issue with SELinux disabled on Fedora Silverblue.

[torvitas]

I think it makes sense to have active selinux as a dependency for something like this. On the other hand you cant have selinux and wine at the same time which breaks it for most desktops.

Maybe it's time to fix selinux/wine.

[HarryMichal]

We could handle SELinux being disabled in some way for sure. I'm curious about wine breaking because of SELinux being enabled. That has never been a case for me before. Both on Silverblue and classic Workstation. And I had a ton of problems. But none of them was solved (or even tried to by solved) by disabling SELinux.

Either way, handling this in some way would be very helpful.

[torvitas]

Maybe I should try wine with selinux enabled again.

[Rafostar]

The biggest issue here is not the requirement of selinux, but that the toolbox exits with a really uninformative error:

toolbox: invalid entry point PID of container fedora-toolbox-31

I think it should at least exit with info that disabled selinux was the cause of being unable to start.

[debarshiray]

Should be fixed by https://github.com/containers/toolbox/pull/360