What happened
On a host whose /tmp is mounted noexec (CIS mount_option_tmp_noexec, which SSG's remediation applies via tmp.mount), every bootc write-path command fails immediately:
$ sudo bootc upgrade
error: Initializing storage: Preparing for write: Ensuring selinux install_t type: execve: Permission denied (os error 13)
bootc status still works (read-only, never reaches prepare_for_write), so bootc-fetch-apply-updates.timer just fails quietly every week and the host looks healthy while it stops updating.
Cause
crates/lib/src/lsm.rs, selinux_ensure_install(): to enter install_t the binary is copied to tempfile::NamedTempFile::new(), labelled like /usr/bin/ostree, and exec'd. NamedTempFile::new() uses std::env::temp_dir(), i.e. $TMPDIR or /tmp. On a noexec mount the execve returns EACCES.
Versions
- bootc 1.15.2 (
bootc-1.15.2-1.el10_2.alma.1, AlmaLinux 10.2 bootc image); the code path is unchanged on main today.
- SELinux enforcing, stock policy.
Workarounds
sudo TMPDIR=/var/tmp bootc upgrade- drop
noexec from /tmp and waive the CIS rule (what we did)
Suggested fix
Put the re-exec copy somewhere that is never noexec and is already root-only, e.g. NamedTempFile::new_in("/run") (tmpfs, /run is not covered by any CIS/STIG noexec rule), or memfd_create + fexecve if the SELinux label can be set on the memfd. Happy to send a PR for the /run variant if that's acceptable.
This will bite any CIS/STIG-hardened image-mode host, since the benchmark's own /tmp remediation produces exactly this mount.
What happened
On a host whose
/tmpis mountednoexec(CISmount_option_tmp_noexec, which SSG's remediation applies viatmp.mount), every bootc write-path command fails immediately:bootc statusstill works (read-only, never reachesprepare_for_write), sobootc-fetch-apply-updates.timerjust fails quietly every week and the host looks healthy while it stops updating.Cause
crates/lib/src/lsm.rs,selinux_ensure_install(): to enterinstall_tthe binary is copied totempfile::NamedTempFile::new(), labelled like/usr/bin/ostree, and exec'd.NamedTempFile::new()usesstd::env::temp_dir(), i.e.$TMPDIRor/tmp. On anoexecmount theexecvereturnsEACCES.Versions
bootc-1.15.2-1.el10_2.alma.1, AlmaLinux 10.2 bootc image); the code path is unchanged onmaintoday.Workarounds
sudo TMPDIR=/var/tmp bootc upgradenoexecfrom/tmpand waive the CIS rule (what we did)Suggested fix
Put the re-exec copy somewhere that is never
noexecand is already root-only, e.g.NamedTempFile::new_in("/run")(tmpfs,/runis not covered by any CIS/STIG noexec rule), ormemfd_create+fexecveif the SELinux label can be set on the memfd. Happy to send a PR for the/runvariant if that's acceptable.This will bite any CIS/STIG-hardened image-mode host, since the benchmark's own
/tmpremediation produces exactly this mount.