`bootc container lint` fails with EACCES on `/sys/fs/selinux/checkreqprot` under rootless podman — regression in 1.16.7 (var-tmpfiles)

[jchecahi]

Environment

• bootc 1.16.7 (regression; 1.16.6 works)
• podman 5.8.4, rootless, crun runtime
• Host: Fedora 43, unprivileged user (no --privileged)
• Originally found on RHEL rhel-bootc images; fully reproduced below with public CentOS Stream bootc images

Description

bootc container lint fails with a fatal error instead of a warning when running inside an unprivileged/rootless container, because the var-tmpfiles lint now tries to access /sys/fs/selinux/checkreqprot and gets EACCES in that environment.

error: Linting: Unexpected runtime error running lint var-tmpfiles: I/O error on /sys/fs/selinux/checkreqprot: Permission denied (os error 13)

selinux-policy ships a tmpfiles.d rule for that path:

/usr/lib/tmpfiles.d/selinux-policy.conf:4:w /sys/fs/selinux/checkreqprot - - - - 0

Reproducer

I used public images and bootc builds, without special privileges. Current CentOS bootc images don't ship with bootc 1.16.7, so I installed it directly from Stream Koji. Specifically, I used centos-bootc:c10s tag, with SHA 2b7e3b1abf8d

Using bootc 1.16.6 (as shipped in the image) — passes with an unrelated warning

-> podman run --rm quay.io/centos-bootc/centos-bootc:c10s sh -c "rpm -q bootc && bootc container lint"
bootc-1.16.6-1.el10.x86_64
Lint warning: var-tmpfiles: Found non-directory/non-symlink files in /var:
  var/roothome/buildinfo/content-sets.json

Checks passed: 12
Checks skipped: 1

Upgrade to bootc 1.16.7 (public CentOS Stream koji build) — fails

-> podman run --rm quay.io/centos-bootc/centos-bootc:c10s sh -c "rpm -U --nodeps https://kojihub.stream.centos.org/kojifiles/vol/koji02/packages/bootc/1.16.7/1.el10/x86_64/bootc-1.16.7-1.el10.x86_64.rpm && rpm -q bootc && bootc container lint"
bootc-1.16.7-1.el10.x86_64
error: Linting: Unexpected runtime error running lint var-tmpfiles: I/O error on /sys/fs/selinux/checkreqprot: Permission denied (os error 13)

Additional information

selinux-policy/libselinux are unchanged between the two runs (only bootc itself was upgraded in place via the RPM above), so this is not a selinux-policy change — it's purely a bootc code change between 1.16.6 and 1.16.7.

Bisecting the release, the commit cfec5cc0 ("tmpfiles: Canonicalize declared tmpfiles.d paths against the rootfs") seems to have relation to this change. It changed var-tmpfiles to walk and canonicalize (stat/inode-compare) every path declared in tmpfiles.d — including entries under /sys that were previously never touched by this lint. When that stat/open hits EACCES (as it does for /sys/fs/selinux/checkreqprot under an unprivileged container), the new code path treats it as an unexpected/fatal error rather than tolerating it.

This looks similar to #1481 (var-tmpfiles crashing on an unhandled I/O errno — there it was ENOSYS under QEMU emulation, here it's EACCES under rootless podman): the lint needs to tolerate "can't stat this path in this sandboxed environment" for paths outside the actual container rootfs content, rather than propagating any I/O error as fatal.

I also tried to reproduce it with quay.io/fedora/fedora-bootc:latest, but the lint passes there. Fedora's selinux-policy (selinux-policy-44.5-1.fc44) does not ship a tmpfiles.d entry for checkreqprot at all — that entry appears to be specific to RHEL/CentOS Stream's selinux-policy. This is consistent with the root cause: the bug is triggered by any tmpfiles.d entry pointing at a restricted/virtual path under /sys, not by something Fedora-specific in bootc's code.

Impact

This breaks any CI/build pipeline that runs bootc container lint as part of podman build without extra privileges — a very common setup — turning a previously-working build into a hard failure on upgrade to 1.16.7.

Workaround

bootc container lint --skip var-tmpfiles

[theEndBeta]

I'm hitting this issue as well with fedora-bootc images for both 43 and 44, but with /sys/kernel/security/ima/binary_runtime_measurements. I was able to work around it temporarily by adding COPY --from=quay.io/centos-bootc/centos-bootc:stream10 /usr/bin/bootc /usr/bin/bootc to my Containerfile, as that is still using 1.16.6.