Bug 1130620

Summary:	SELinux is preventing /var/lib/docker/init/dockerinit-1.1.2 from 'relabelfrom' accesses on the chr_file 17.
Product:	[Fedora] Fedora	Reporter:	Lukas Slebodnik <lslebodn>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	21	CC:	dominick.grift, dwalsh, lvrabec, mgrepl
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Unspecified
Whiteboard:	abrt_hash:ed95aa52dc68da50877750a04f413164cf3fb84379a92b3f1248631ea1ef8a05
Fixed In Version:	selinux-policy-3.13.1-78.fc21	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-09-10 02:45:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lukas Slebodnik 2014-08-15 16:51:40 UTC

Description of problem:
I executed command:
[root@host ~]# docker run -t -i --rm fedora:20 /bin/bash
SELinux is preventing /var/lib/docker/init/dockerinit-1.1.2 from 'relabelfrom' accesses on the chr_file 17.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that dockerinit-1.1.2 should be allowed relabelfrom access on the 17 chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep dockerinit-1.1. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:docker_t:s0
Target Context                system_u:object_r:docker_devpts_t:s0
Target Objects                17 [ chr_file ]
Source                        dockerinit-1.1.
Source Path                   /var/lib/docker/init/dockerinit-1.1.2
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-72.fc21.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.16.0-1.fc21.x86_64 #1 SMP Mon
                              Aug 4 10:01:25 UTC 2014 x86_64 x86_64
Alert Count                   2
First Seen                    2014-08-15 18:41:44 CEST
Last Seen                     2014-08-15 18:49:23 CEST
Local ID                      85603566-4ffc-4a69-9094-3552a5ddbe05

Raw Audit Messages
type=AVC msg=audit(1408121363.955:764): avc:  denied  { relabelfrom } for  pid=11427 comm="dockerinit-1.1." name="17" dev="devpts" ino=20 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:docker_devpts_t:s0 tclass=chr_file permissive=1


type=AVC msg=audit(1408121363.955:764): avc:  denied  { relabelto } for  pid=11427 comm="dockerinit-1.1." name="17" dev="devpts" ino=20 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c333,c421 tclass=chr_file permissive=1


type=SYSCALL msg=audit(1408121363.955:764): arch=x86_64 syscall=lsetxattr success=yes exit=0 a0=c2080ce6f0 a1=c2080b6d00 a2=c2080c6440 a3=33 items=0 ppid=4022 pid=11427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts17 ses=4294967295 comm=dockerinit-1.1. exe=/var/lib/docker/init/dockerinit-1.1.2 subj=system_u:system_r:docker_t:s0 key=(null)

Hash: dockerinit-1.1.,docker_t,docker_devpts_t,chr_file,relabelfrom

Version-Release number of selected component:
selinux-policy-3.13.1-72.fc21.noarch

Additional info:
reporter:       libreport-2.2.3
hashmarkername: setroubleshoot
kernel:         3.16.0-1.fc21.x86_64
type:           libreport

Comment 1 Lukas Slebodnik 2014-08-15 16:53:05 UTC

Another AVC caused by the same command

SELinux is preventing /var/lib/docker/init/dockerinit-1.1.2 from 'getattr' accesses on the file /proc/kcore.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that dockerinit-1.1.2 should be allowed getattr access on the kcore file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep dockerinit-1.1. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:docker_t:s0
Target Context                system_u:object_r:proc_kcore_t:s0
Target Objects                /proc/kcore [ file ]
Source                        dockerinit-1.1.
Source Path                   /var/lib/docker/init/dockerinit-1.1.2
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-72.fc21.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.16.0-1.fc21.x86_64 #1 SMP Mon
                              Aug 4 10:01:25 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-08-15 18:49:23 CEST
Last Seen                     2014-08-15 18:49:23 CEST
Local ID                      3c5be748-3a69-4e75-baef-05c196cee361

Raw Audit Messages
type=AVC msg=audit(1408121363.955:765): avc:  denied  { getattr } for  pid=11427 comm="dockerinit-1.1." path="/proc/kcore" dev="proc" ino=4026531992 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file permissive=1


type=SYSCALL msg=audit(1408121363.955:765): arch=x86_64 syscall=stat success=yes exit=0 a0=c2080ce710 a1=c20804ba70 a2=0 a3=0 items=0 ppid=4022 pid=11427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts17 ses=4294967295 comm=dockerinit-1.1. exe=/var/lib/docker/init/dockerinit-1.1.2 subj=system_u:system_r:docker_t:s0 key=(null)

Hash: dockerinit-1.1.,docker_t,proc_kcore_t,file,getattr

Comment 2 Lukas Slebodnik 2014-08-15 16:53:28 UTC

SELinux is preventing /var/lib/docker/init/dockerinit-1.1.2 from 'mounton' accesses on the directory /proc/irq.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that dockerinit-1.1.2 should be allowed mounton access on the irq directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep dockerinit-1.1. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:docker_t:s0
Target Context                system_u:object_r:sysctl_irq_t:s0
Target Objects                /proc/irq [ dir ]
Source                        dockerinit-1.1.
Source Path                   /var/lib/docker/init/dockerinit-1.1.2
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-72.fc21.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.16.0-1.fc21.x86_64 #1 SMP Mon
                              Aug 4 10:01:25 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-08-15 18:49:23 CEST
Last Seen                     2014-08-15 18:49:23 CEST
Local ID                      d687b916-03ff-43a1-8423-6bf43a0038c5

Raw Audit Messages
type=AVC msg=audit(1408121363.971:766): avc:  denied  { mounton } for  pid=11427 comm="dockerinit-1.1." path="/proc/irq" dev="proc" ino=4026531857 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:sysctl_irq_t:s0 tclass=dir permissive=1


type=SYSCALL msg=audit(1408121363.971:766): arch=x86_64 syscall=mount success=yes exit=0 a0=c2080ce7f0 a1=c2080ce800 a2=c2080ce7f9 a3=1000 items=0 ppid=4022 pid=11427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts17 ses=4294967295 comm=dockerinit-1.1. exe=/var/lib/docker/init/dockerinit-1.1.2 subj=system_u:system_r:docker_t:s0 key=(null)

Hash: dockerinit-1.1.,docker_t,sysctl_irq_t,dir,mounton

Comment 3 Lukas Slebodnik 2014-08-15 16:54:26 UTC

And the last one 4/4

SELinux is preventing /var/lib/docker/init/dockerinit-1.1.2 from 'mounton' accesses on the file /proc/kcore.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that dockerinit-1.1.2 should be allowed mounton access on the kcore file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep dockerinit-1.1. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:docker_t:s0
Target Context                system_u:object_r:proc_kcore_t:s0
Target Objects                /proc/kcore [ file ]
Source                        dockerinit-1.1.
Source Path                   /var/lib/docker/init/dockerinit-1.1.2
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-72.fc21.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.16.0-1.fc21.x86_64 #1 SMP Mon
                              Aug 4 10:01:25 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-08-15 18:49:23 CEST
Last Seen                     2014-08-15 18:49:23 CEST
Local ID                      7c9dc856-6ca2-460a-b68e-67a4358a909a

Raw Audit Messages
type=AVC msg=audit(1408121363.971:767): avc:  denied  { mounton } for  pid=11427 comm="dockerinit-1.1." path="/proc/kcore" dev="proc" ino=4026531992 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file permissive=1


type=SYSCALL msg=audit(1408121363.971:767): arch=x86_64 syscall=mount success=yes exit=0 a0=c2080ce882 a1=c2080ce890 a2=c2080ce88c a3=1000 items=0 ppid=4022 pid=11427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts17 ses=4294967295 comm=dockerinit-1.1. exe=/var/lib/docker/init/dockerinit-1.1.2 subj=system_u:system_r:docker_t:s0 key=(null)

Hash: dockerinit-1.1.,docker_t,proc_kcore_t,file,mounton

Comment 4 Daniel Walsh 2014-08-15 18:20:10 UTC

b85c1c66d788756b4ae012db94a9df84f5ffce18 and 
ced59d262c6151f9245fe63c6fd4a4e6b8b3464f fixes this in git.

Add these access to docker.

Since docker is permissive everything should have worked fine.

Comment 5 Lukas Vrabec 2014-08-16 00:37:14 UTC

Backp ported also to F20

Comment 6 Lukas Slebodnik 2014-08-16 10:11:27 UTC

(In reply to Daniel Walsh from comment #4)
> b85c1c66d788756b4ae012db94a9df84f5ffce18 and 
> ced59d262c6151f9245fe63c6fd4a4e6b8b3464f fixes this in git.
> 
> Add these access to docker.
> 
> Since docker is permissive everything should have worked fine.
Yes, I didn't noticed any problem. I just want to get rid of AVCs. i should have mentioned it in 1st comment.

Comment 7 Lukas Vrabec 2014-08-16 15:15:57 UTC

Anyway Lukas thank you for Report.

Comment 8 Fedora Update System 2014-08-28 14:10:52 UTC

selinux-policy-3.13.1-77.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-77.fc21

Comment 9 Fedora Update System 2014-08-28 16:42:36 UTC

Package selinux-policy-3.13.1-77.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-77.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-9873/selinux-policy-3.13.1-77.fc21
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2014-09-02 19:29:36 UTC

selinux-policy-3.13.1-78.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-78.fc21

Comment 11 Fedora Update System 2014-09-10 02:45:52 UTC

selinux-policy-3.13.1-78.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.