From: Marc-André Lureau <marcandre.lureau@redhat.com>

The cross-compilation container mounts lack the :z SELinux label.
On Fedora with SELinux enforcing, container_t is denied read
access to user_home_t files, failing the build.

Add :z to volume mounts in docker.py CompilerRecipe and in the
TCG meson.build, matching the existing extra source paths.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 tests/docker/docker.py | 2 +-
 tests/tcg/meson.build  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/docker/docker.py b/tests/docker/docker.py
index 315fa2ff848f..bdfea380339d 100755
--- a/tests/docker/docker.py
+++ b/tests/docker/docker.py
@@ -626,7 +626,7 @@ def run(self, args, argv):
             argv = argv[1:]
         cwd = os.getcwd()
         cmd = ["-w", cwd,
-               "-v", "%s:%s:rw" % (cwd, cwd)]
+               "-v", "%s:%s:rw,z" % (cwd, cwd)]
         if args.paths:
             for p in args.paths:
                 cmd += ["-v", "%s:%s:ro,z" % (p, p)]
diff --git a/tests/tcg/meson.build b/tests/tcg/meson.build
index d41a228fb3df..221c277dd09a 100644
--- a/tests/tcg/meson.build
+++ b/tests/tcg/meson.build
@@ -266,7 +266,7 @@ foreach target, plan: tcg_tests
       build_test_depends += image_targets[cc_dockerfile]
       build_test_depend_files += dockerfile
       mount = meson.project_source_root()
-      mount = mount + ':' + mount
+      mount = mount + ':' + mount + ':z'
       here = meson.project_build_root()
       cc = [docker_wrapper, 'run', '--run-as-current-user',
             '-w', here, '-v', mount,
-- 
2.55.0.543.g5ebe2ebe4ea8

Hi

On Fri, Sep 11, 2026 at 7:44 PM <marcandre.lureau@redhat.com> wrote:
>
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
>
> The cross-compilation container mounts lack the :z SELinux label.
> On Fedora with SELinux enforcing, container_t is denied read
> access to user_home_t files, failing the build.
>
> Add :z to volume mounts in docker.py CompilerRecipe and in the
> TCG meson.build, matching the existing extra source paths.
>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

superseded by Pierrick's version:
https://patchew.org/QEMU/20260917221117.274619-1-pierrick.bouvier@oss.qualcomm.com/

> ---
>  tests/docker/docker.py | 2 +-
>  tests/tcg/meson.build  | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/tests/docker/docker.py b/tests/docker/docker.py
> index 315fa2ff848f..bdfea380339d 100755
> --- a/tests/docker/docker.py
> +++ b/tests/docker/docker.py
> @@ -626,7 +626,7 @@ def run(self, args, argv):
>              argv = argv[1:]
>          cwd = os.getcwd()
>          cmd = ["-w", cwd,
> -               "-v", "%s:%s:rw" % (cwd, cwd)]
> +               "-v", "%s:%s:rw,z" % (cwd, cwd)]
>          if args.paths:
>              for p in args.paths:
>                  cmd += ["-v", "%s:%s:ro,z" % (p, p)]
> diff --git a/tests/tcg/meson.build b/tests/tcg/meson.build
> index d41a228fb3df..221c277dd09a 100644
> --- a/tests/tcg/meson.build
> +++ b/tests/tcg/meson.build
> @@ -266,7 +266,7 @@ foreach target, plan: tcg_tests
>        build_test_depends += image_targets[cc_dockerfile]
>        build_test_depend_files += dockerfile
>        mount = meson.project_source_root()
> -      mount = mount + ':' + mount
> +      mount = mount + ':' + mount + ':z'
>        here = meson.project_build_root()
>        cc = [docker_wrapper, 'run', '--run-as-current-user',
>              '-w', here, '-v', mount,
> --
> 2.55.0.543.g5ebe2ebe4ea8
>
>