Bug 1227071

Summary: SELinux is preventing lxc-start from 'mounton' accesses on the directory /usr/lib64/lxc/rootfs/proc/1/net.
Product: [Fedora] Fedora Reporter: Yogesh Sharma <yogeshsharma>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 22CC: dominick.grift, dwalsh, jclaverogarcia, jorti, lantw44, lvrabec, mgrepl, moath.alhamaideh, plautrba, taylor.m.wagner, tim
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:9dddaece0a5671e86dcad3e510440aac5655b5a4519193dc0441d26283055c94
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-19 14:27:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Default install of LXC none

Description Yogesh Sharma 2015-06-01 21:59:50 UTC
Description of problem:
Default install of LXC
Think LVM based Backend
SELinux is preventing lxc-start from 'mounton' accesses on the directory /usr/lib64/lxc/rootfs/proc/1/net.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that lxc-start should be allowed mounton access on the net directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep lxc-start /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Objects                /usr/lib64/lxc/rootfs/proc/1/net [ dir ]
Source                        lxc-start
Source Path                   lxc-start
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-126.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 4.0.4-301.fc22.x86_64 #1 SMP Thu
                              May 21 13:10:33 UTC 2015 x86_64 x86_64
Alert Count                   3
First Seen                    2015-06-01 14:42:34 PDT
Last Seen                     2015-06-01 14:49:03 PDT
Local ID                      5f2f8a58-9be5-490a-ab6a-9f7eed6339fc

Raw Audit Messages
type=AVC msg=audit(1433195343.932:711): avc:  denied  { mounton } for  pid=3986 comm="lxc-start" path="/usr/lib64/lxc/rootfs/proc/1/net" dev="proc" ino=90891 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=1


Hash: lxc-start,unconfined_t,unconfined_t,dir,mounton

Version-Release number of selected component:
selinux-policy-3.13.1-126.fc22.noarch

Additional info:
reporter:       libreport-2.5.1
hashmarkername: setroubleshoot
kernel:         4.0.4-301.fc22.x86_64
type:           libreport

Comment 1 Ting-Wei Lan 2015-06-19 18:50:50 UTC
More error messages:

lxc-start: conf.c: lxc_mount_auto_mounts: 819 Permission denied - error mounting /usr/lib64/lxc/rootfs/proc/sys/net on /usr/lib64/lxc/rootfs/proc/net flags 4096

type=AVC msg=audit(1434739703.963:3527): avc:  denied  { mounton } for  pid=9173 comm="lxc-start" path="/usr/lib64/lxc/rootfs/proc/1/net" dev="proc" ino=4117235 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0

type=SYSCALL msg=audit(1434739703.963:3527): arch=x86_64 syscall=mount success=no exit=EACCES a0=1e83430 a1=1e81fe0 a2=0 a3=1000 items=0 ppid=9166 pid=9173 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts10 ses=2 comm=lxc-start exe=/usr/bin/lxc-start subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

Comment 2 Taylor Wagner 2015-06-26 17:46:39 UTC
Description of problem:
1: install lxc
2: create any container
3: config container to use virbr0 instead of lxcbr0
4: attempt to start the container using lxc-start.
	-denied

Version-Release number of selected component:
selinux-policy-3.13.1-128.1.fc22.noarch

Additional info:
reporter:       libreport-2.6.0
hashmarkername: setroubleshoot
kernel:         4.0.4-303.fc22.x86_64
type:           libreport

Comment 3 Fedora End Of Life 2016-07-19 14:27:41 UTC
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 4 moad 2022-10-18 06:34:43 UTC
Created attachment 1918718 [details]
Default install of LXC

Comment 5 Red Hat Bugzilla 2023-09-18 00:11:31 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days