Issue

What were you trying to do that didn't work? Migrated a VMware VM to OpenShift Virtualization using MTV 2.11.2 The VM is a single node containerized Ansible Automation Platform installation using rootless Podman storage under: /home/admin/.local/share/containers/storage The migration completed successfully, and the VM booted after migration. However, after migration, AAP components such as EDA and Hub containers keep restarting when SELinux is enforcing. The guest logs show SELinux denials, for example: ~~~ PermissionError: [Errno 13] Permission denied: '/etc/eda/SECRET_KEY' SELinux is preventing /usr/bin/python3.12 from read access on the file eda_secret_key ~~~~ Disabling SELinux allows the application to start and work. After investigation, the SECRET_KEY files are not directly on the VM root filesystem under /etc/eda. They are inside the rootless Podman overlay storage, for example: ~~~ /home/admin/.local/share/containers/storage/overlay/<id>/diff/etc/eda/SECRET_KEY /home/admin/.local/share/containers/storage/overlay/<id>/diff/etc/tower/SECRET_KEY /home/admin/.local/share/containers/storage/overlay/<id>/diff/etc/ansible-automation-platform/gateway/SECRET_KEY ~~~~ On the source VMware VM, those files have SELinux labels like: ~~~ system_u:object_r:container_file_t:s0:cXXX,cYYY ~~~ After migration, the same files have labels like: ~~~ unconfined_u:object_r:container_ro_file_t:s0 ~~~ The virt-v2v log also shows that SELinux relabeling was executed during conversion and that /home was included in the relabel scope. This means virt-v2v SELinux relabeling changed labels inside rootless Podman storage, including container_file_t + MCS labels, which appears to break the migrated containerized AAP installation. What is the impact of this issue to you? The VM migration itself completes successfully, but the migrated application is not functional with SELinux enforcing. AAP EDA/Hub containers keep restarting after migration. The application only works if SELinux is disabled, which is not an acceptable production workaround. Please provide the package NVR for which the bug is seen: How reproducible is this bug?: Steps to reproduce Install a RHEL VM on VMware with a containerized Ansible Automation Platform deployment using rootless Podman storage under /home/<user>/.local/share/containers/storage. Confirm files inside Podman overlay storage have labels such as container_file_t with MCS categories, for example: system_u:object_r:container_file_t:s0:cXXX,cYYY Migrate the VM from VMware to OpenShift Virtualization using MTV 2.11. Boot the migrated VM with SELinux enforcing. Check AAP/Podman containers and SELinux AVCs. Compare SELinux labels inside /home/<user>/.local/share/containers/storage/overlay before and after migration. Expected results virt-v2v should not break rootless Podman container storage SELinux labels during conversion. Files inside rootless Podman storage should keep valid container labels, including container_file_t and MCS categories, or virt-v2v should skip relabeling those directories if the SELinux policy cannot safely reconstruct the labels. The migrated VM should boot and the containerized AAP services should run with SELinux enforcing. Actual results virt-v2v SELinux relabeling includes /home and changes labels inside rootless Podman storage. Source VM example labels: system_u:object_r:container_file_t:s0:c160,c726 system_u:object_r:container_file_t:s0:c433,c577 system_u:object_r:container_file_t:s0:c1022,c1023 Migrated VM example labels: unconfined_u:object_r:container_ro_file_t:s0 After migration, AAP EDA/Hub containers fail with SELinux AVCs and keep restarting. The application works only when SELinux is disabled. Additional notes The virt-v2v documentation says SELinux relabeling is performed by default unless --no-selinux-relabel is used.

Release Notes

No. of Comments

Resolution

Unresolved