Bug 1229433

Summary:	--priv containers run as docker_t not spc_t
Product:	[Fedora] Fedora	Reporter:	Eric Paris <eparis>
Component:	docker	Assignee:	Lokesh Mandvekar <lsm5>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	23	CC:	admiller, dwalsh, ichavero, jcajka, jchaloup, lsm5, lvrabec, miminar, vbatts
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-02-16 20:05:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Eric Paris 2015-06-08 17:50:52 UTC

docker-1.7.0-15.gitdcff4e1.fc23.x86_64

docker run -ti --rm fedora:latest /bin/bash
dnf install -y procps-ng
ps -efZ

# ps -efZ
LABEL                           UID        PID  PPID  C STIME TTY          TIME CMD
system_u:system_r:docker_t:s0   root         1     0  0 17:49 ?        00:00:00 /bin/bash
system_u:system_r:docker_t:s0   root        31     1  0 17:50 ?        00:00:00 ps -efZ




Seems to me this should be spc_t, not docker_t

Comment 1 Lokesh Mandvekar 2015-06-08 18:47:26 UTC

Dan, is this a docker-selinux issue?

Comment 2 Daniel Walsh 2015-06-08 19:03:59 UTC

Yes.

I have the lates docker.pp installed and I see the following

# docker run --privileged --rm -ti fedora /bin/sh
# cat /proc/self/attr/current
system_u:system_r:spc_t:s0sh-4.3#

So I don't think you have the latest docker-selinux package updated.

Comment 3 Eric Paris 2015-06-08 19:15:45 UTC

docker-selinux-1.7.0-15.gitdcff4e1.fc23.x86_64

Comment 4 Daniel Walsh 2015-06-08 19:25:08 UTC

Yes I am not sure Lokesh has been grabbing latest code out of 

git:fedora-cloud/docker-selinux.git


 grep spc_t docker.te 
type spc_t;
domain_type(spc_t)
role system_r types spc_t;
kernel_unlabeled_entry_type(spc_t)
kernel_unlabeled_domtrans(docker_t, spc_t)
domain_entry_file(spc_t, docker_share_t)
domain_entry_file(spc_t, docker_var_lib_t)
role system_r types spc_t;
domain_entry_file(spc_t, docker_share_t)
domain_entry_file(spc_t, docker_var_lib_t)
domtrans_pattern(docker_t, docker_share_t, spc_t)
domtrans_pattern(docker_t, docker_var_lib_t, spc_t)
allow docker_t spc_t:process { setsched signal_perms };
ps_process_pattern(docker_t, spc_t)
allow docker_t spc_t:socket_class_set { relabelto relabelfrom };
	dbus_chat_system_bus(spc_t)
	unconfined_domain_noaudit(spc_t)
	virt_transition_svirt_sandbox(spc_t, system_r)

Comment 5 Lokesh Mandvekar 2015-06-08 19:42:12 UTC

whoops, gotta modify my daily rebuild script to pull in from docker-selinux master.

This will be fixed in 1.7.0-16

Comment 6 Eric Paris 2015-06-08 20:33:58 UTC

-16 seems better to me!

Comment 7 Daniel Walsh 2015-06-09 12:09:13 UTC

Make sure we get this out to F21, F22 and RHEL7 packages.

Comment 8 Jan Kurik 2015-07-15 14:02:54 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 23 development cycle.
Changing version to '23'.

(As we did not run this process for some time, it could affect also pre-Fedora 23 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 23 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora23