Tag: policycoreutils-python-utils

The default LXC container folder in CentOS (all versions – 7,8, Stream 8 and Stream 9) is /var/lib/lxc, which may resides in the root partition. When changing the lxc.rootfs or (the main directory /var/lib/lxc) to another place, the containers may still work without any additional SELinux permissions. Some tools like lxc-attach would definitely stop working with permission errors – lxc_attach_run_shell: 1333 Permission denied – failed to exec shell. This article will show how to use lxc-create and SELinux commands to properly change the LXC container’s rootfs.
For detailed information how to create a LXC container check out – Run LXC CentOS Stream 9 container with bridged network under CentOS Stream 9 or Run LXC Ubuntu 22.04 LTS container with bridged network under CentOS Stream 9.

Create LXC container with not default path

• Change the rootfs only. To change only the LXC container root filesystem location use “–dir=” lxc-create option:

  lxc-create --template download -n mycontainer2 --dir=/mnt/storage/servers/mycontainer2 -- --dist centos --release 9-Stream --arch amd64
  

  It will place the files under /mnt/storage/servers/mycontainer2, but the configuration will still be located in /var/lib/lxc/mycontainer2/.

  [root@srv ~]# ls -altr /var/lib/lxc/mycontainer2/
  total 16
  drwxr-xr-x. 3 root root 4096 Oct 14 13:42 ..
  drwxr-xr-x. 2 root root 4096 Oct 14 13:42 rootfs
  -rw-r-----. 1 root root  775 Oct 14 13:42 config
  drwxrwx---. 3 root root 4096 Oct 14 13:42 .
  [root@srv ~]# ls -altr /var/lib/lxc/mycontainer2/rootfs/
  total 8
  drwxr-xr-x. 2 root root 4096 Oct 14 13:42 .
  drwxrwx---. 3 root root 4096 Oct 14 13:42 ..
  [root@srv ~]# ls -altr /mnt/storage/servers/mycontainer2/
  total 76
  drwxrwxrwt.  2 root root 4096 Aug  9  2021 tmp
  drwxr-xr-x.  2 root root 4096 Aug  9  2021 srv
  lrwxrwxrwx.  1 root root    8 Aug  9  2021 sbin -> usr/sbin
  drwxr-xr-x.  2 root root 4096 Aug  9  2021 opt
  drwxr-xr-x.  2 root root 4096 Aug  9  2021 mnt
  drwxr-xr-x.  2 root root 4096 Aug  9  2021 media
  lrwxrwxrwx.  1 root root    9 Aug  9  2021 lib64 -> usr/lib64
  lrwxrwxrwx.  1 root root    7 Aug  9  2021 lib -> usr/lib
  drwxr-xr-x.  2 root root 4096 Aug  9  2021 home
  dr-xr-xr-x.  2 root root 4096 Aug  9  2021 boot
  lrwxrwxrwx.  1 root root    7 Aug  9  2021 bin -> usr/bin
  dr-xr-xr-x.  2 root root 4096 Aug  9  2021 afs
  dr-xr-xr-x.  2 root root 4096 Oct 14 07:11 sys
  dr-xr-xr-x.  2 root root 4096 Oct 14 07:11 proc
  drwxr-xr-x. 12 root root 4096 Oct 14 07:11 usr
  drwxr-xr-x.  8 root root 4096 Oct 14 07:11 run
  drwxr-xr-x. 18 root root 4096 Oct 14 07:11 var
  dr-xr-x---.  2 root root 4096 Oct 14 07:12 root
  drwxr-xr-x.  2 root root 4096 Oct 14 07:12 selinux
  drwxr-xr-x. 19 root root 4096 Oct 14 07:15 .
  drwxr-xr-x.  4 root root 4096 Oct 14 13:41 ..
  drwxr-xr-x.  3 root root 4096 Oct 14 13:42 dev
  drwxr-xr-x. 63 root root 4096 Oct 14 13:42 etc
  

• Change the LXC container path – the folder containing the configuration and the container’s root filesystems use “-P”

  lxc-create -P /mnt/storage/servers/ --template download -n mycontainer -- --dist centos --release 9-Stream --arch amd64
  

  All the LXC container configuration and root filesystem will be placed under /mnt/storage/servers/[container_name], which in the example above is /mnt/storage/servers/mycontainer

  [root@srv ~]# ls -al /mnt/storage/servers/mycontainer
  total 16
  drwxrwx---.  3 root root 4096 Oct 14 13:38 .
  drwxr-xr-x.  4 root root 4096 Oct 14 13:41 ..
  -rw-r-----.  1 root root  780 Oct 14 13:38 config
  drwxr-xr-x. 19 root root 4096 Oct 14 07:15 rootfs
  

It is better to use the “-P” and to change the LXC container location than only the filesystem path. In this case, a good practice is to make a symbolic link in /var/lib/lxc/[container-name] to the new location:

ln -s /mnt/storage/servers/mycontainer /var/lib/lxc/mycontainer

So all LXC tools will continue to work without explicitly adding an option for the new path of this container.

Change the SELinux file context to be container_var_lib_t of the LXC root filesystem

Add the file context container_var_lib_t to the container’s root filesystem path and change the SELinux labels.
First, verify all the needed tools are installed:

dnf install -y policycoreutils-python-utils container-selinux

Then, add a new file context to the path /mnt/storage/servers/mycontainer and run the restorecon to change the SELinux labels to container_var_lib_t

semanage fcontext -a -t container_var_lib_t '/mnt/storage/servers/mycontainer(/.*)?'
restorecon -Rv /mnt/storage/servers/mycontainer

The file context may be shown with:

[root@srv ~]# ls -alZ /mnt/storage/servers/mycontainer
total 16
drwxrwx---.  3 root root unconfined_u:object_r:container_var_lib_t:s0 4096 Oct 14 13:38 .
drwxr-xr-x.  4 root root unconfined_u:object_r:mnt_t:s0               4096 Oct 14 13:41 ..
-rw-r-----.  1 root root unconfined_u:object_r:container_var_lib_t:s0  780 Oct 14 13:38 config
drwxr-xr-x. 19 root root unconfined_u:object_r:container_var_lib_t:s0 4096 Oct 14 07:15 rootfs

Failing to set the proper SELinux labels may result to errors such as lxc_attach_run_shell: 1333 Permission denied – failed to exec shell