coreos/rpm-ostree

drop rofiles-fuse, start using overlayfs

Closed this issue · 7 comments

alexlarsson commented

On an automotive cs9 image, using composefs this command fails:

# rpm-ostree install --apply-live --idempotent --allow-inactive -y fontconfig
...
error: Running %posttrans for fontconfig: bwrap(/bin/sh): Child process killed by signal 2; 
run `journalctl -t 'rpm-ostree(fontconfig.posttrans)'` for more information

The log says is:

# journalctl -t 'rpm-ostree(fontconfig.posttrans)'
Feb 12 09:33:16 74fb4ccc-a8ac-435e-83be-4b69a8bdd037.testing-farm rpm-ostree(fontconfig.posttrans)[1154]: 
could not open /etc/xml/catalog for saving

The actual post-trans is:

%posttrans
if [ -e %{_sysconfdir}/xml/catalog ]; then
  %{_bindir}/xmlcatalog --noout --add system \
                        "urn:fontconfig:fonts.dtd" \
                        "file://%{_datadir}/xml/fontconfig/fonts.dtd" \
                        %{_sysconfdir}/xml/catalog
fi

I don't understand why this breaks, because /etc should still be the regular bind-mount even though composefs is used (i.e. it is not using e.g. transient /etc. However, I don't know the details of apply-live.

alexlarsson commented

I did some investigation, and /etc is on a rofiles-fuse mount with -copyup, so writes to it should work. However, it doesn't. Trying to modify an existing file (which should break the hardlink and replace it) like so:

echo foo > $ETC/fuse.conf

Fails with:

/tmp/rpmostree-rofiles-fusedtvOpD/fuse.conf: Operation not permitted

I wonder if it somehow is using the composefs dir as backing for the rofiles, and not the deploy dirs.

cgwalters commented

In a quick test, I am not reproducing this on FCOS (fedora 39).

That said, I can't even enable composefs in the current centos-bootc:stream9 images as dbus-broker.service fails to launch...wait...this used to work...

(some debugging)

Argh it it's that's dang patch for rhel to disable tmp.mount by default...this is a recent bug there.

alexlarsson commented

So, the problem happens because the file we're replacing has fs-verity enabled.

cgwalters commented

Oh yeah duh, so this is an ostree bug: verify_write_or_copyup is just not prepared for this.

cgwalters commented

Obviously package layering here should stop using rofiles-fuse and use overlayfs instead (and more generally align with container builds).

alexlarsson commented

Its not actually in verify_write_or_copyup(), but before it, see the linked PR.