evilsocket / evilsocket/opensnitch

[Bug Report] RPM postinstall script breaks installation during chrooted/containerised install

Open
#1,586 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Python
Stars
14.1k
Forks
665
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug:
The postinstall section for the RPMs directly call systemctl to enable, start and disable opensnitchd.service. On a traditional system these connect to a running systemd. In simple chroots or a containerised build, particularly when extending Fedora bootable container images, systemctl returns exit code 1 and dnf does not declare the RPM transaction successful.

Include the following information:
- OpenSnitch version: 1.8.0
- OS: Fedora bootc
- OS version: 43
- Window Manager:
- Kernel version:

### To Reproduce:

Steps to reproduce the behavior:
1. Put the following Containerfile somewhere:
```dockerfile
FROM quay.io/fedora/fedora-bootc:43

RUN dnf5 -y install 'https://github.com/evilsocket/opensnitch/releases/download/v1.8.0/opensnitch-1.8.0-1.x86_64.rpm'
```
2. Do `podman build .` or `docker build .`

### Post error logs:

```
STEP 1/2: FROM quay.io/fedora/fedora-bootc:43
STEP 2/2: RUN dnf5 -y install 'https://github.com/evilsocket/opensnitch/releases/download/v1.8.0/opensnitch-1.8.0-1.x86_64.rpm'
Updating and loading repositories:
Fedora 43 openh264 (From Cisco) - x86_ 100% | 10.2 KiB/s | 5.8 KiB | 00m01s
Fedora 43 - x86_64 100% | 19.7 MiB/s | 35.5 MiB | 00m02s
Fedora 43 - x86_64 - Updates 100% | 18.3 MiB/s | 29.4 MiB | 00m02s
Fedora 43 - x86_64 - Updates Archive 100% | 19.3 MiB/s | 37.1 MiB | 00m02s
Repositories loaded.
https://github.com/evilsocket/opensnit 100% | 56.6 MiB/s | 6.3 MiB | 00m00s
Package Arch Version Repository Size
Installing:
opensnitch x86_64 1.8.0-1 @commandline 17.8 MiB
Installing dependencies:
info x86_64 7.2-7.fc43 updates 353.9 KiB
libnetfilter_queue x86_64 1.0.5-12.fc43 fedora 52.8 KiB

Transaction Summary:
Installing: 3 packages

Total size of inbound packages is 6 MiB. Need to download 211 KiB.
After this operation, 18 MiB extra will be used (install 18 MiB, remove 0 B).
[1/2] libnetfilter_queue-0:1.0.5-12.fc4 100% | 1.4 MiB/s | 28.3 KiB | 00m00s
[2/2] info-0:7.2-7.fc43.x86_64 100% | 2.1 MiB/s | 182.7 KiB | 00m00s
--------------------------------------------------------------------------------
[2/2] Total 100% | 2.3 MiB/s | 211.0 KiB | 00m00s
Running transaction
Importing OpenPGP key 0x31645531:
UserID : "Fedora (43) "
Fingerprint: C6E7F081CF80E13146676E88829B606631645531
From : file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-43-x86_64
The key was successfully imported.
[1/5] Verify package files 100% | 176.0 B/s | 3.0 B | 00m00s
[2/5] Prepare transaction 100% | 73.0 B/s | 3.0 B | 00m00s
[3/5] Installing info-0:7.2-7.fc43.x86_ 100% | 20.4 MiB/s | 354.3 KiB | 00m00s
[4/5] Installing libnetfilter_queue-0:1 100% | 26.4 MiB/s | 54.0 KiB | 00m00s
[5/5] Installing opensnitch-0:1.8.0-1.x 100% | 56.8 MiB/s | 17.8 MiB | 00m00s
>>> Running %post scriptlet: opensnitch-0:1.8.0-1.x86_64
>>> Non-critical error in %post scriptlet: opensnitch-0:1.8.0-1.x86_64
>>> Scriptlet output:
>>> Created symlink '/etc/systemd/system/multi-user.target.wants/opensnitch.serv
>>> System has not been booted with systemd as init system (PID 1). Can't operat
>>> Failed to connect to system scope bus via local transport: Host is down
>>>
>>> [RPM] %post(opensnitch-1.8.0-1.x86_64) scriptlet failed, exit status 1
Transaction failed: Rpm transaction failed.
Warning: skipped OpenPGP checks for 1 package from repository: @commandline
Error: building at STEP "RUN dnf5 -y install 'https://github.com/evilsocket/opensnitch/releases/download/v1.8.0/opensnitch-1.8.0-1.x86_64.rpm'": while running runtime: exit status 1
```

### Expected behavior (optional):

The RPM installs succesfully and is included in a bootable container image.

### Screenshots:

### Additional context:

A workaround is to disable scripts when installing the daemon package by passing `--setopt=tsflags=noscripts` to dnf.

RPMs from Fedora tend not to enable systemd unit files during install. If it is still desired to automatically enable opensnitchd.service a mechanism that would work in all cases would be to include a [systemd preset drop-in file](https://www.freedesktop.org/software/systemd/man/latest/systemd.preset.html).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.