I am using a podman container to cross-compile and build a Linux system using bitbake and Yocto. I use a shared volume to contain the results of this. Everything works, but there’s a long delay when I first start the container because it’s busy applying selinux labels to every file in the volume (there are over 8 million files in over 900,000 directories). I will not turn off selinux, but I do want to avoid the need to relabel every time I start the container. I tried adding --security-opt label=level:s0:c5,c9 to the command to start this podman container, but that did not seem to speed things up at all, even after the first time. I’ve read on this Red Hat Developer article about various security options, and I typically use the Z suffix to indicate that this volume will not be shared with other containers. However, as it notes:
If you have a volume which contains millions of files, relabeling might be too cumbersome. If the source Volume for this content is a file system, one option you could investigate for the volume would be to use a context mount for the entire file system. Search for a description of context mounts under the mount man page.
Ok, I do have millions of files and relabeling is too cumbersome, but the source Volume is not a file system, but just a subdirectory. Is there any hope for avoiding relabeling every time without forfeiting the security of selinux?
It sounds like you have ruled out loosening :Z to :z (which would make the labelling a one-off exercise only).
Have you considered the Udica option mentioned in that article?
It can create a dedicated SELinux type for your container content Then you need to relabel only once, and you can pass the generated type to your container in --security-opt.
I have not ruled out loosening :Z to :z; rather, I didn’t (and don’t) understand how that would change the relabeling behavior. Would I need to also use the same --security-opt flag that I’m currently using? Can you point me to relevant documentation to explain that further?
As for the Udica option, yes, I considered it but understand even less about it, even after installing it and reading the man page. I’m more than willing to read and learn, but I don’t really know where else to look for this.
:Z makes the files accessible uniquely to the specific container that you mounted the volume to. That requires a new label to be generated and applied each time a container is created (and remember each podman run creates a new container, even if you have already used the same image in an older container). Hence the slow startup you are seeing.
:z makes the files accessible to all Podman containers, so there is no need for the dynamic generation of a per-container label and therefore only one iteration of relabelling.
No. Just specifying :z on the volume mapping is sufficient to make it set a shared label, no need for an explicit --security-opt.
It’s covered in point 3 of the doc you linked to, although there’s an unfortunate typo in the first sentence - it says :Z when it should say :z.
For the official documentation, see the “Labeling Volume Mounts” heading in the docs for podman-run.