Setting SELinux security attributes fails on --tmpfs (setfattr: Not supported)

[peppergrayxyz]

Issue Description

Setting SELinux security attributes fails on --tmpfs:

$ setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' x
setfattr: x: Not supported

Steps to reproduce the issue

Validate this works on the host:

touch /tmp/test
setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' /tmp/test

enter a container with:

-v /tmp:/a 
--tmpfs /b

Validate this works in the container:

# touch x
# touch /a/x
# setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' /x
# setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' /a/x

Issue:

# touch /b/x
# setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' /b/x
setfattr: /b/x: Not supported

Describe the results you received

setfattr: /b/x: Not supported

Describe the results you expected

it works

podman info output

host:
  arch: arm64
  buildahVersion: 1.44.0
  cdiSpecDirs:
  - /etc/cdi
  - /var/run/cdi
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - pids
  - rdma
  - misc
  - dmem
  cgroupManager: cgroupfs
  cgroupVersion: v2
  conmon:
    package: app-containers/conmon-2.2.1
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.2.1, commit: unknown'
  cpuUtilization:
    idlePercent: 98.75
    systemPercent: 0.26
    userPercent: 0.98
  cpus: 80
  databaseBackend: sqlite
  distribution:
    distribution: '''gentoo'''
    version: '''2.18'''
  emulatedArchitectures:
  - linux/386
  - linux/amd64
  - linux/arm64be
  - linux/loong64
  - linux/ppc
  - linux/ppc64
  - linux/riscv32
  - linux/riscv64
  eventLogger: file
  freeLocks: 2024
  hostname: altrad8ud-1l2t
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 7.1.2-gentoo-dist-hardened
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 480753377280
  memTotal: 539286142976
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: app-containers/aardvark-dns-2.0.0
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 2.0.0
    package: app-containers/netavark-2.0.0
    path: /usr/libexec/podman/netavark
    version: netavark 2.0.0
  ociRuntime:
    name: crun
    package: app-containers/crun-1.28
    path: /usr/bin/crun
    version: |-
      crun version 1.28
      commit: 54f16ffbefcd022bf032af768b5c5ce075c18bfc
      rundir: /run/crun
      spec: 1.0.0
      +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +JSON_C
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: net-misc/passt-2026.05.26
    version: |
      pasta 2026.05.26
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  rootlessPortForwarder: rootlessport
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  swapFree: 8589930496
  swapTotal: 8589930496
  uptime: 99h 54m 21.00s (Approximately 4.12 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries: {}
store:
  containerStore:
    number: 24
    paused: 0
    running: 0
    stopped: 24
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 3927884406784
  graphRootUsed: 1573588283392
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 6.0.0
  BuildOrigin: Gentoo Portage
  Built: 1783258880
  BuiltTime: Sun Jul  5 15:41:20 2026
  GitCommit: ""
  GoVersion: go1.26.3-X:nodwarf5
  Os: linux
  OsArch: linux/arm64
  Version: 6.0.0

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

No response

Additional information

fstab: tmpfs /tmp tmpfs rw,nosuid,nodev,noexec,mode=1700,rootcontext=system_u:object_r:tmp_t:s0 0 0

[Functionhx]

I'd like to work on this. Have a fix ready — SELinux tmpfs mounts now get fscontext= to enable the security.* xattr handler, with global MountLabel cleared to prevent OCI runtime from layering duplicate context=.

[Luap99]

see #29174 (review)
https://docs.podman.io/en/latest/markdown/podman-create.1.html#security-opt-option

I think you need at least --security-opt label=nested otherwise this is not expected to work

[peppergrayxyz]

I use podman to run rootfs (not container) like so:

#!/usr/bin/env bash

rootfs="$1"

podman run --rm -it \
    -v /tmp:/a \
    --tmpfs /b \
    --rootfs "$(pwd)/$rootfs" \
    /bin/bash --login

Which gives me the results shown above.

Adding --security-opt label=nested makes
# setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' /b/x
work.

Yet this behaviour still makes no sense to me, because mounts are handled differently than --tmpfs.

Also when I set --security-opt label=disabled I still end up with the same result, like when I don't add the option:

# touch x
# touch /a/x
# setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' /x
# setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' /a/x
# touch /b/x
# setfattr -n security.selinux -v 'system_u:object_r:bin_t:s0' /b/x
setfattr: /b/x: Not supported