Bug 1133654

Created attachment 930610 [details]
C program to demonstrate the issue

Description of problem:

With docker installed in Fedora 20, and selinux in enforcing/targetted mode, an attempt to bind a raw socket within a docker container fails with EPERM, with a selinux AVC logged.

Note that creating a raw socket is not prevented, only the bind.  As a bind of a raw socket actually restricts the data received on the socket, it is hard to see why preventing this might be beneficial.

Version-Release number of selected component (if applicable):
3.12.1-180.fc20

How reproducible:
Always

Steps to Reproduce:
1. Start a docker container (e.g. with 'docker run -t -i fedora /bin/bash')
2. Copy the attached program raw.c into the container and compile it with 'gcc raw.c', or compile it outside and copy the resulting binary in.
3. Run the binary inside the container (as root) with no arguments.

Actual results:

bash-4.2# /tmp/a.out 
bind: Permission denied

To confirm the program's behaviour, here is the relevant output from 'strace /tmp/a.out':

[...]
socket(PF_INET, SOCK_RAW, IPPROTO_TCP)  = 3
bind(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EACCES (Permission denied)
[...]

On the host, in /var/log/audit/audit.log, the following AVC message appears:

type=AVC msg=audit(1408987654.899:52228): avc:  denied  { node_bind } for  pid=31187 comm="a.out" saddr=127.0.0.1 scontext=system_u:system_r:svirt_lxc_net_t:s0:c509,c751 tcontext=system_u:object_r:node_t:s0 tclass=rawip_socket

Expected results:

The program should run without error, printing messages of the form 'Got packet of size N' when the raw socket yields packets.

Additional info:

The attached program is a simple example to demonstrate the problem; the issue was encountered while trying to run a real application under docker.

The program operates as expected outside of a docker container, or inside a docker container with selinux set to permissive mode.

Examination of serefpolicy-contrib-3.12.1/virt.te, lines 1081 onwards, seems to confirm that svirt_lxc_net_t processes can create, read and write raw sockets, but not bind them.