Skip to content

[release-4.22] USHIFT-7240: work around kernel 7.x SELinux execmem denial on EL10 bootc#6910

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:release-4.22from
openshift-cherrypick-robot:cherry-pick-6903-to-release-4.22
Jun 20, 2026
Merged

[release-4.22] USHIFT-7240: work around kernel 7.x SELinux execmem denial on EL10 bootc#6910
openshift-merge-bot[bot] merged 1 commit into
openshift:release-4.22from
openshift-cherrypick-robot:cherry-pick-6903-to-release-4.22

Conversation

@openshift-cherrypick-robot

@openshift-cherrypick-robot openshift-cherrypick-robot commented Jun 19, 2026

Copy link
Copy Markdown

This is an automated cherry-pick of #6903

/assign eslutsky

@eslutsky @claude
SELinux: allow kernel_t execmem to work around composefs regression
c427745 
Add allow rule to the microshift SELinux policy module so that CRI-O
can perform text relocations when running as kernel_t on composefs.
This is needed until the RHEL 10.2 kernel backports the upstream fix
(880bd496ec72, 6af36aeb147a, 82544d36b172).

USHIFT-7215

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Jun 19, 2026
Merged
3 tasks
@openshift-ci-robot

openshift-ci-robot commented Jun 19, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@openshift-cherrypick-robot: Ignoring requests to cherry-pick non-bug issues: USHIFT-7240

Details

In response to this:

This is an automated cherry-pick of #6903

/assign eslutsky

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: aa60f8fc-fd3d-424c-9162-b723c1ef1e88

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot requested review from jerpeter1 and vanhalenar June 19, 2026 12:08
@eslutsky

eslutsky commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

/retest

@pacevedom

pacevedom commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

/override ci/prow/e2e-aws-tests
/override ci/prow/e2e-aws-tests-arm

Unrelated error

@pacevedom

pacevedom commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

/verified by CI

@openshift-ci

openshift-ci Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

@pacevedom: Overrode contexts on behalf of pacevedom: ci/prow/e2e-aws-tests, ci/prow/e2e-aws-tests-arm

Details

In response to this:

/override ci/prow/e2e-aws-tests
/override ci/prow/e2e-aws-tests-arm

Unrelated error

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

openshift-ci Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

@openshift-cherrypick-robot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-tests-arm c427745 link true /test e2e-aws-tests-arm
ci/prow/e2e-aws-tests c427745 link true /test e2e-aws-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

pacevedom
pacevedom approved these changes Jun 20, 2026
View reviewed changes

@pacevedom pacevedom left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jun 20, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 20, 2026

Copy link
Copy Markdown

@pacevedom: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jun 20, 2026
@pacevedom

pacevedom commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

/label backport-risk-assessed

@openshift-ci

openshift-ci Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: openshift-cherrypick-robot, pacevedom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. labels Jun 20, 2026
@pacevedom

pacevedom commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

/label jira/valid-bug

@openshift-ci openshift-ci Bot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jun 20, 2026
@openshift-merge-bot openshift-merge-bot Bot merged commit e1a527e into openshift:release-4.22 Jun 20, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pacevedom pacevedom pacevedom approved these changes

@jerpeter1 jerpeter1 Awaiting requested review from jerpeter1

@vanhalenar vanhalenar Awaiting requested review from vanhalenar

Assignees

@eslutsky eslutsky

@pacevedom pacevedom

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@openshift-cherrypick-robot @openshift-ci-robot @eslutsky @pacevedom