images: fix centos-10

[allisonkarlitskaya]

Fixes #6376

• image-refresh centos-10

[cockpituous]

image-refresh centos-10 done: https://github.com/cockpit-project/bots/commits/image-refresh-centos-10-20240514-041151

[cockpituous]

Success. Log: https://cockpit-logs.us-east-1.linodeobjects.com/image-refresh-centos-10-fdf4c864-20240514-035722/log.html

[jelly]

SELinux failure galore:

audit: type=1400 audit(1715689616.964:4): avc:  denied  { map_read map_write } for  pid=488 comm="nfs-server-gene" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0
audit: type=1400 audit(1715689616.993:5): avc:  denied  { map_read map_write } for  pid=501 comm="systemd-rc-loca" scontext=system_u:system_r:systemd_rc_local_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0
audit: type=1400 audit(1715689617.016:6): avc:  denied  { map_read map_write } for  pid=498 comm="systemd-gpt-aut" scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0
audit: type=1400 audit(1715689617.031:7): avc:  denied  { map_read map_write } for  pid=496 comm="systemd-fstab-g" scontext=system_u:system_r:systemd_fstab_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0
audit: type=1400 audit(1715689617.055:8): avc:  denied  { map_read map_write } for  pid=504 comm="systemd-sysv-ge" scontext=system_u:system_r:systemd_sysv_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=

NBDE fails:

warning: Unexpected PackageKit error during installation of clevis-dracut: Error: Could not depsolve transaction; 1 problem detected:
 Problem: conflicting requests
  - nothing provides dracut-network needed by clevis-dracut-19-6.el10.x86_64 from updates

[allisonkarlitskaya]

Lovely :(

Thanks for the cherry-pick.

[martinpitt]

I have some more fixes queued. I also want a fresh build to pick up kdumpctl.

[cockpituous]

Failed. Log: https://cockpit-logs.us-east-1.linodeobjects.com/image-refresh-centos-10-9dcd959e-20240522-051044/log.html

[cockpituous]

Failed. Log: https://cockpit-logs.us-east-1.linodeobjects.com/image-refresh-centos-10-9dcd959e-20240522-052626/log.html

[martinpitt]

That failure reproduces. After installing packages, /etc/resolv.conf is a broken symlink. systemctl start systemd-resolved fixes it.

I noticed that during my initial experiments and thought it was a glitch, but it's systematic. Our initial image doesn't have systemd-resolved installed. But installing wireguard-tools pulls in systemd-resolved as a dependency, and its rpm script changes /etc/resolv.conf.

So: installing wireguard-tools breaks DNS, because installing systemd-resolved changes the symlink but doesn't start the service. I filed that as https://issues.redhat.com/browse/RHEL-37686 and will add a workaround.

[cockpituous]

image-refresh centos-10 done: https://github.com/cockpit-project/bots/commits/image-refresh-centos-10-20240522-073543

[cockpituous]

Success. Log: https://cockpit-logs.us-east-1.linodeobjects.com/image-refresh-centos-10-7c27fdc5-20240522-072129/log.html

[martinpitt]

SELinux issues are https://issues.redhat.com/browse/RHEL-37631 , added ignore.

[martinpitt]

Green now! It's @allisonkarlitskaya 's PR, so she can't formally review. But I'm good with the dhcp-change, and someone else needs to review my changes.

[allisonkarlitskaya]

✔️ 👍 (if I could).