Bug 1392611

Summary:	Unable to start a container in RHEL 7.3 with SELinux enabled
Product:	Red Hat Enterprise Linux 7	Reporter:	jcallaha
Component:	docker	Assignee:	Lokesh Mandvekar <lsm5>
Status:	CLOSED CURRENTRELEASE	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	7.3	CC:	amurdaca, asogukpi, brad+rhbz, carl, dwalsh, lsm5, redhat.bugs, santiago
Target Milestone:	rc	Keywords:	Extras
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-06-30 16:05:23 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description jcallaha 2016-11-07 21:44:32 UTC

Description of problem:
It looks like we are encountering this since upgrading to RHEL 7.3. On my personal boxes, as well as our automation testing framework for Satellite 6, we are blocked by what appears to be this bug. If selinux is disabled, then containers run properly. 

[root@rhsm-qe-1 content-host-d]# docker run hello-world
permission denied
docker: Error response from daemon: Container command could not be invoked..

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 7.3 (Maipo)

How reproducible:
Always

Steps to Reproduce:
1. Ensure selinux is enabled.
2. Attempt to run a container

Actual results:
[root@rhsm-qe-1 content-host-d]# docker run hello-world
permission denied
docker: Error response from daemon: Container command could not be invoked..

Expected results:
The container runs properly, without disabling selinux

Additional info:
It looks like this bug, which was closed, may be the same issue. https://bugzilla.redhat.com/show_bug.cgi?id=1327740

Comment 2 Daniel Walsh 2016-11-07 21:50:11 UTC

There seems to be a mismatch in the docker-selinux package.  I am not sure if the right version was shipped.
Simple fix is to do

chcon -t docker_exec_t /usr/bin/docker*

systemctl restart docker

And everything should work.

Comment 3 jcallaha 2016-11-07 22:05:02 UTC

That was indeed a simple fix! How soon can we get the proper version in?

fyi

[root@rhsm-qe-1 content-host-d]# rpm -qa | grep docker
docker-selinux-1.10.3-46.el7.14.x86_64
python-pulp-docker-common-2.0.3-1.el7sat.noarch
docker-rhel-push-plugin-1.10.3-46.el7.14.x86_64
docker-1.10.3-46.el7.14.x86_64
tfm-rubygem-hammer_cli_foreman_docker-0.0.6-1.el7sat.noarch
docker-common-1.10.3-46.el7.14.x86_64
tfm-rubygem-docker-api-1.28.0-1.el7sat.noarch
pulp-docker-plugins-2.0.3-1.el7sat.noarch
tfm-rubygem-foreman_docker-2.0.1.11-1.el7sat.noarch

Comment 5 Brad Durrow 2016-12-14 15:55:44 UTC

This is causing this issue:
https://github.com/openshift/openshift-ansible/issues/2978