containers / containers/toolbox
“failed: Operation not permitted” appears when installing `@development-tools`.
- Dominant language
- Go
- Stars
- 3.5k
- Forks
- 262
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
#### Description of the bug
> A clear and concise description of *what the bug is*. If possible, re-run the command(s) with `--log-level debug` and put the output here.
As demonstrated in the undermentioned log, I see `failed: Operation not permitted` when installing `@development-tools` in `toolbox`.
#### Steps to reproduce the behaviour [^1]
1. ~~~sh
#!/usr/bin/env sh
toolbox create
~~~
1. ~~~sh
#!/usr/bin/env sh
toolbox enter
~~~
1. Install Homebrew:
> ~~~bash
> #!/usr/bin/env bash
> curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh
> ~~~
1. ~~~sh
#!/usr/bin/env sh
sudo dnf5 group install development-tools -y
~~~
[^1]: [`facebook/idb/issues/876#issuecomment-2743674937`](https://github.com/facebook/idb/issues/876#issuecomment-2743674937)
#### Expected behaviour
I'd like to display the expected output, but I can't easily reinstall the package on my host system, due to [`rpm-software-management/dnf5/issues/501#issuecomment-2743914761`](https://github.com/rpm-software-management/dnf5/issues/501#issuecomment-2743914761). Ultimately, I *presume* that I shouldn't be seeing access denials.
#### Actual behaviour
~~~py
[115/115] Installing diffstat-0:1.66-2.fc41.x86_64 100% | 39.3 KiB/s | 78.0 KiB | 00m02s
>>> Running trigger-install scriptlet: systemd-0:256.12-1.fc41.x86_64
>>> Finished trigger-install scriptlet: systemd-0:256.12-1.fc41.x86_64
>>> Scriptlet output:
>>> fchownat() of /run/systemd/sessions failed: Operation not permitted
>>> fchownat() of /run/systemd/users failed: Operation not permitted
>>> fchownat() of /var/lib/systemd/coredump failed: Operation not permitted
>>> fchownat() of /tmp failed: Operation not permitted
>>> Setting access ACL "u::rwx,g::r-x,g:adm:r-x,g:wheel:r-x,g:4294967295:r-x,g:4294967295:r-x,m::r-x,o::r-x" on /var/log/journal failed: Invalid argument
>>> Failed to reopen '/var/log/journal': Operation not permitted
>>> fchownat() of /var/log/journal failed: Operation not permitted
>>> Setting access ACL "u::rwx,g::r-x,g:adm:r-x,g:wheel:r-x,g:4294967295:r-x,g:4294967295:r-x,m::r-x,o::r-x" on /var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8 failed: Invalid argument
>>> Failed to reopen '/var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8': Operation not permitted
>>> fchownat() of /var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8 failed: Operation not permitted
>>> fchownat() of /dev/snd/seq failed: Operation not permitted
>>> fchownat() of /dev/snd/timer failed: Operation not permitted
>>> fchownat() of /dev/loop-control failed: Operation not permitted
>>> fchownat() of /dev/kvm failed: Operation not permitted
>>> fchownat() of /dev/vhost-net failed: Operation not permitted
>>> fchownat() of /dev/vhost-vsock failed: Operation not permitted
>>> Setting access ACL "u::rw-,g::r-x,g:adm:r--,g:wheel:r--,g:4294967295:r--,g:4294967295:r--,m::r--,o::---" on /var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8/system.journal failed: Invalid argument
>>> fchownat() of /var/log/journal/b4f0bef5ffd640fba0ab31fdaa2820b8/system.journal failed: Operation not permitted
>>>
>>> Running trigger-install scriptlet: systemd-0:256.12-1.fc41.x86_64
>>> Finished trigger-install scriptlet: systemd-0:256.12-1.fc41.x86_64
>>> Scriptlet output:
>>> Reload daemon failed: Access denied
>>>
Complete!
~~~
[^2]
[^2]: [`discussion.fedoraproject.org/t/36013/41#p-390174-evaluation-2`](https://discussion.fedoraproject.org/t/install-and-use-homebrew-on-fedora/36013/41#p-390174-evaluation-2:~:text=for%20mentioning%20it.-,Evaluation,-Gregory%20Lee%20Bartholomew:)
#### Output of `toolbox --version` (v0.0.90+)
1. ~~~sh
#!/usr/bin/env sh
toolbox --version
~~~
1. > toolbox version 0.1.1
#### Toolbx package info (`rpm -q toolbox`)
1. ~~~sh
#!/usr/bin/env sh
rpm -qa toolbox
~~~
1. > `toolbox-0.1.1-1.fc41.x86_64`
#### Output of `podman version`
1. ~~~sh
#!/usr/bin/env sh
podman version
~~~
1. > ~~~YAML
> Client: Podman Engine
> Version: 5.4.1
> API Version: 5.4.1
> Go Version: go1.23.7
> Git Commit: b79bc8afe796cba51dd906270a7e1056ccdfcf9e
> Built: Tue Mar 11 00:00:00 2025
> Build Origin: Fedora Project
> OS/Arch: linux/amd64
> ~~~
#### Podman package info (`rpm -q podman`)
1. ~~~sh
#!/usr/bin/env sh
rpm -qa podman
~~~
1. > `podman-5.4.1-1.fc41.x86_64`
#### Info about your OS
1. ~~~sh
#!/usr/bin/env sh
cat /etc/os-release | grep -E CPE_NAME
~~~
1. > ~~~ini
> CPE_NAME="cpe:/o:fedoraproject:fedora:41"
> ~~~
#### Additional context
I shan't be surprised if this relates to [`issues/1609`](https://github.com/containers/toolbox/issues/1609#issue-2796422671).
Contributor guide
Research direction
Start by reproducing `toolbox create`, `toolbox enter`, and `sudo dnf5 group install development-tools -y` on Fedora 41 with the reported Toolbx and Podman versions. Compare the behavior with issues 1609 and the linked dnf5 and Fedora discussions; done means determining whether the access-denied output is expected or identifying a Toolbx change that prevents it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- fedora, go, linux
- Domain
- cli, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100