containers / containers/toolbox

“failed: Operation not permitted” appears when installing `@development-tools`.

Open
#1,618 1 comment 3 reactions 0 assignees View on GitHub
1. Bug
Dominant language
Go
Stars
3.5k
Forks
262
Avg merge
3d 1h
Merged PRs (30d)
1

Description

#### Description of the bug

> A clear and concise description of *what the bug is*. If possible, re-run the command(s) with `--log-level debug` and put the output here.

As demonstrated in the undermentioned log, I see `failed: Operation not permitted` when installing `@development-tools` in `toolbox`.

#### Steps to reproduce the behaviour [^1]

1. ~~~sh
#!/usr/bin/env sh
toolbox create
~~~

1. ~~~sh
#!/usr/bin/env sh
toolbox enter
~~~

1. Install Homebrew:

> ~~~bash
> #!/usr/bin/env bash
> curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh
> ~~~

1. ~~~sh
#!/usr/bin/env sh
sudo dnf5 group install development-tools -y
~~~

[^1]: [`facebook/idb/issues/876#issuecomment-2743674937`](https://github.com/facebook/idb/issues/876#issuecomment-2743674937)

#### Expected behaviour

I'd like to display the expected output, but I can't easily reinstall the package on my host system, due to [`rpm-software-management/dnf5/issues/501#issuecomment-2743914761`](https://github.com/rpm-software-management/dnf5/issues/501#issuecomment-2743914761). Ultimately, I *presume* that I shouldn't be seeing access denials.

#### Actual behaviour

~~~py
[115/115] Installing diffstat-0:1.66-2.fc41.x86_64 100% | 39.3 KiB/s | 78.0 KiB | 00m02s
>>> Running trigger-install scriptlet: systemd-0:256.12-1.fc41.x86_64
>>> Finished trigger-install scriptlet: systemd-0:256.12-1.fc41.x86_64
>>> Scriptlet output:
>>> fchownat() of /run/systemd/sessions failed: Operation not permitted
>>> fchownat() of /run/systemd/users failed: Operation not permitted
>>> fchownat() of /var/lib/systemd/coredump failed: Operation not permitted
>>> fchownat() of /tmp failed: Operation not permitted
>>> Setting access ACL "u::rwx,g::r-x,g:adm:r-x,g:wheel:r-x,g:4294967295:r-x,g:4294967295:r-x,m::r-x,o::r-x" on /var/log/journal failed: Invalid argument
>>> Failed to reopen '/var/log/journal': Operation not permitted
>>> fchownat() of /var/log/journal failed: Operation not permitted
>>> Setting access ACL "u::rwx,g::r-x,g:adm:r-x,g:wheel:r-x,g:4294967295:r-x,g:4294967295:r-x,m::r-x,o::r-x" on /var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8 failed: Invalid argument
>>> Failed to reopen '/var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8': Operation not permitted
>>> fchownat() of /var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8 failed: Operation not permitted
>>> fchownat() of /dev/snd/seq failed: Operation not permitted
>>> fchownat() of /dev/snd/timer failed: Operation not permitted
>>> fchownat() of /dev/loop-control failed: Operation not permitted
>>> fchownat() of /dev/kvm failed: Operation not permitted
>>> fchownat() of /dev/vhost-net failed: Operation not permitted
>>> fchownat() of /dev/vhost-vsock failed: Operation not permitted
>>> Setting access ACL "u::rw-,g::r-x,g:adm:r--,g:wheel:r--,g:4294967295:r--,g:4294967295:r--,m::r--,o::---" on /var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8/system.journal failed: Invalid argument
>>> fchownat() of /var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8/system.journal failed: Operation not permitted
>>>
>>> Running trigger-install scriptlet: systemd-0:256.12-1.fc41.x86_64
>>> Finished trigger-install scriptlet: systemd-0:256.12-1.fc41.x86_64
>>> Scriptlet output:
>>> Reload daemon failed: Access denied
>>>
Complete!
~~~

[^2]

[^2]: [`discussion.fedoraproject.org/t/36013/41#p-390174-evaluation-2`](https://discussion.fedoraproject.org/t/install-and-use-homebrew-on-fedora/36013/41#p-390174-evaluation-2:~:text=for%20mentioning%20it.-,Evaluation,-Gregory%20Lee%20Bartholomew:)

#### Output of `toolbox --version` (v0.0.90+)

1. ~~~sh
#!/usr/bin/env sh
toolbox --version
~~~

1. > toolbox version 0.1.1

#### Toolbx package info (`rpm -q toolbox`)

1. ~~~sh
#!/usr/bin/env sh
rpm -qa toolbox
~~~

1. > `toolbox-0.1.1-1.fc41.x86_64`

#### Output of `podman version`

1. ~~~sh
#!/usr/bin/env sh
podman version
~~~

1. > ~~~YAML
> Client: Podman Engine
> Version: 5.4.1
> API Version: 5.4.1
> Go Version: go1.23.7
> Git Commit: b79bc8afe796cba51dd906270a7e1056ccdfcf9e
> Built: Tue Mar 11 00:00:00 2025
> Build Origin: Fedora Project
> OS/Arch: linux/amd64
> ~~~

#### Podman package info (`rpm -q podman`)

1. ~~~sh
#!/usr/bin/env sh
rpm -qa podman
~~~

1. > `podman-5.4.1-1.fc41.x86_64`

#### Info about your OS

1. ~~~sh
#!/usr/bin/env sh
cat /etc/os-release | grep -E CPE_NAME
~~~

1. > ~~~ini
> CPE_NAME="cpe:/o:fedoraproject:fedora:41"
> ~~~

#### Additional context

I shan't be surprised if this relates to [`issues/1609`](https://github.com/containers/toolbox/issues/1609#issue-2796422671).

Contributor guide

Open the contributing guide

Research direction

Start by reproducing `toolbox create`, `toolbox enter`, and `sudo dnf5 group install development-tools -y` on Fedora 41 with the reported Toolbx and Podman versions. Compare the behavior with issues 1609 and the linked dnf5 and Fedora discussions; done means determining whether the access-denied output is expected or identifying a Toolbx change that prevents it.

Written by the indexing model from the issue text.

Assessment

Tech stack
fedora, go, linux
Domain
cli, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.