Permissions denied when mounting files

[FilBot3]

Looking at

• user containers have Permission denied on data #19397

I also had issues:

➜  filbot3.github.io git:(main) ✗ 
> task serve                        
task: [serve] hugo --config=config.local.toml serve --buildDrafts --bind=0.0.0.0 
Watching for changes in /src/{archetypes,assets,content,data,layouts,static,themes}
Watching for config changes in /src/config.local.toml, /src/themes/hugo-flex/config.yaml
Start building sites … 
hugo v0.124.1-db083b05f16c945fec04f745f0ca8640560cf1ec+extended linux/amd64 BuildDate=2024-03-20T11:40:10Z

Built in 4 ms
Error: error building site: process: readAndProcessContent: walk: Readdir: lstat /src/content/posts/images/Polyhedral_Frames.png: permission denied

I looked at my SELinux, and just bare with me here.

First I looked at the SELinux Label.

➜  filbot3.github.io git:(main) ✗ 
> ls -Z content/posts/images/Polyhedral_Frames.png 
unconfined_u:object_r:user_home_t:s0 content/posts/images/Polyhedral_Frames.png

Then I compared this to a file taht I know to be working.

➜  filbot3.github.io git:(main) ✗ 
> ls -Z content/posts/changing-up-binary-pass-fail.md 
unconfined_u:object_r:container_file_t:s0 content/posts/changing-up-binary-pass-fail.md

Notice the Type is different: user_home_t instead of container_file_t. I'm running hugo from a container to generate content. So I had to change the Type to match.

➜  filbot3.github.io git:(main) ✗ 
> chcon -t container_file_t content/posts/images/Polyhedral_Frames.png

Now I was able to load hugo.

➜  filbot3.github.io git:(main) ✗ 
> task serve
task: [serve] hugo --config=config.local.toml serve --buildDrafts --bind=0.0.0.0 
Watching for changes in /src/{archetypes,assets,content,data,layouts,static,themes}
Watching for config changes in /src/config.local.toml, /src/themes/hugo-flex/config.yaml
Start building sites … 
hugo v0.124.1-db083b05f16c945fec04f745f0ca8640560cf1ec+extended linux/amd64 BuildDate=2024-03-20T11:40:10Z


                   | EN  
-------------------+-----
  Pages            | 36  
  Paginator pages  |  0  
  Non-page files   |  1  
  Static files     |  1  
  Processed images |  0  
  Aliases          |  1  
  Cleaned          |  0  

Built in 24 ms
Environment: "development"
Serving pages from disk
Running in Fast Render Mode. For full rebuilds on change: hugo server --disableFastRender
Web Server is available at http://localhost:1313/ (bind address 0.0.0.0) 
Press Ctrl+C to stop
^Ctask: signal received: interrupt

Hopefully this helps someone.

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/sect-security-enhanced_linux-working_with_selinux-selinux_contexts_labeling_files
• https://www.redhat.com/sysadmin/container-permission-denied-errors

[rhatdan]

Please sow the AVC messages before adding custom policy.