build_image fails on 3815_2_5

[mrbojangles3]

Hello,
I was following the steps to build the sdk from source. the build_image step fails for me. I am using Fedora 40, but I don't believe that should make a big difference. Below is the error output

ERROR   build_image: script called: build_image 
ERROR   build_image: Backtrace:  (most recent call is last)
ERROR   build_image:   file build_image, line 170, called: create_prod_image 'flatcar_production_image.bin' 'base' 'developer' 'coreos-base/coreos' 'containerd-flatcar:app-containers/containerd,docker-flatcar:app-containers/docker&app-containers/docker-cli'
ERROR   build_image:   file prod_image_util.sh, line 168, called: finish_image 'flatcar_production_image.bin' 'base' '/mnt/host/source/src/build/images/amd64-usr/developer-3815.2.5+2024-07-22-1447-a1/rootfs' 'flatcar_production_image_contents.txt' 'flatcar_production_image_contents_wtd.txt' 'flatcar_production_image.vmlinuz' 'flatcar_production_image_pcr_policy.zip' 'flatcar_production_image.grub' 'flatcar_production_image.shim' 'flatcar_production_image_kernel_config.txt' 'flatcar_production_image_initrd_contents.txt' 'flatcar_production_image_initrd_contents_wtd.txt' 'flatcar_production_image_disk_usage.txt'
ERROR   build_image:   file build_image_util.sh, line 759, called: die_err_trap 'sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"/etc' '255'
ERROR   build_image: 
ERROR   build_image: Command failed:
ERROR   build_image:   Command 'sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"/etc' exited with nonzero code: 255
INFO    build_image: Cleaning up mounts
An error occurred in your build so your latest output directory is invalid.
Would you like to delete the output directory (y/N)? n
Not deleting /mnt/host/source/src/build/images/amd64-usr/developer-3815.2.5+2024-07-22-1447-a1.
sdk@flatcar-sdk-all-3815_0_0_os-stable-3815_2_5 ~/trunk/src/scripts $ ./build_image 

I apologize if this is not the right place to ask questions.

[tormath1]

Hello @mrbojangles3, it's totally the right place to ask questions (you can also join the #flatcar Matrix channel: https://app.element.io/#/room/#flatcar:matrix.org for more interactive discussion).

The issue seems to be with the SELinux labelling of /etc - is SELinux enabled on your Fedora machine? (sestatus -v / getenforce)

[mrbojangles3]

It is enabled and enforcing. I assume the quick solution is to disable it for building purposes, correct?

The motivation for this excellent journey into the SDK is to make an ISO with a user defined ignition file so that flatcar-install can be run with the ignition file. My other thought was to make a simple bootable iso and just include all the tools needed to run flatcar-install.

[tormath1]

While I don't like recommending to disable SELinux, I think you could try to disable it for building purposes as it might interact with the SELinux policy loaded in your kernel.

Did you check with the existing ISO image: https://stable.release.flatcar-linux.net/amd64-usr/current/flatcar_production_iso_image.iso? It embeds the flatcar-install tool that you can use to install Flatcar on disk for example.

[mrbojangles3]

I agree on the SELinux thought. There is a tool called udica that is supposed to help this kind of situation.

If you are available, I have joined the matrix chat to talk about the iso topic.

[mrbojangles3]

I have tried udica and sadly it didn't magically solve my problems. But the project is still under active development so it would be worth revisiting at a later date.

For anyone who comes after and views this message. I had to have the SDK container running, supply the name and container id to udica. In the file that udica generated the first line has .'s in it. A character that is not allowed by semodule command. so I edited the file to replace the . with - and it seemed to accept it. The .'s were introduced based on the name of the container.
After restarting the container I still got a similar build error from the build_image command.

I will be trying to disable selinux as my next step.

[mrbojangles3]

Move selinux from enforcing to permissive via /etc/selinux/config allowed the build_image command to succeed.