Bug 1398861

Summary:

SELinux is preventing systemd from 'create' accesses on the unix_stream_socket Unknown.

Product:

[Fedora] Fedora

Reporter:

Lukas Slebodnik <lslebodn>

Component:

docker

Assignee:

Antonio Murdaca <amurdaca>

Status:

CLOSED EOL

QA Contact:

Fedora Extras Quality Assurance <extras-qa>

Severity:

unspecified

Docs Contact:

Priority:

unspecified

Version:

CC:

2284577490, adimania, admiller, akmalkmrzmn, alexander.a.kononov, amurdaca, arturpolak1, benn-h, dominick.grift, dwalsh, eugene.murray, goodmirek, ichavero, jan.public, jcajka, jchaloup, laurentc3, lsm5, lvrabec, marianne, mattgatto, mgrepl, miminar, mttl.tushar13, nalin, plautrba, pmoore, pradeepk.dev, riek, sgallagh, ssekidde, vbatts

Target Milestone:

---

Keywords:

Reopened

Target Release:

---

Hardware:

x86_64

OS:

Unspecified

Whiteboard:

abrt_hash:3105d14f21e59edb726bf898f9802a354518963c750a7e1cd2349c661e1c3dba;VARIANT_ID=server;

Fixed In Version:

docker-1.12.4-2.git1b5971a.fc25 docker-1.12.4-6.git1b5971a.fc25

Doc Type:

If docs needed, set a value

Doc Text:

Story Points:

---

Clone Of:

Clones:

1418405 (view as bug list)

Environment:

Last Closed:

2018-05-29 11:30:23 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
This patch should cause docker.rpm to relabel /usr/bin/docker* and /usr/libexec/docker	none
AVCs	none

Description Lukas Slebodnik 2016-11-26 18:00:29 UTC

Description of problem:
sh# systemctl start rhel-push-plugin.service
A dependency job for rhel-push-plugin.service failed. See 'journalctl -xe' for details.

Nov 26 18:55:50 host audit[1]: AVC avc:  denied  { create } for  pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service
Nov 26 18:55:50 host systemd[1]: rhel-push-plugin.socket: Failed to listen on sockets: Permission denied
Nov 26 18:55:50 host systemd[1]: Failed to listen on Docker Block RHEL push plugin Socket for the API.
Nov 26 18:55:50 host systemd[1]: Dependency failed for Docker Block RHEL push plugin authZ Plugin.
Nov 26 18:55:50 host systemd[1]: rhel-push-plugin.service: Job rhel-push-plugin.service/start failed with result 'dependency'.
SELinux is preventing systemd from 'create' accesses on the unix_stream_socket Unknown.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd should be allowed create access on the Unknown unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:system_r:unconfined_service_t:s0
Target Objects                Unknown [ unix_stream_socket ]
Source                        systemd
Source Path                   systemd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-226.fc26.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.8.8-300.fc25.x86_64 #1 SMP Tue
                              Nov 15 18:10:06 UTC 2016 x86_64 x86_64
Alert Count                   6
First Seen                    2016-11-26 18:51:15 CET
Last Seen                     2016-11-26 18:55:50 CET
Local ID                      309bb3bd-28b6-4995-8305-90147f79412f

Raw Audit Messages
type=AVC msg=audit(1480182950.829:704): avc:  denied  { create } for  pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=0


Hash: systemd,init_t,unconfined_service_t,unix_stream_socket,create

Version-Release number of selected component:
selinux-policy-3.13.1-226.fc26.noarch

Additional info:
reporter:       libreport-2.8.0
hashmarkername: setroubleshoot
kernel:         4.8.8-300.fc25.x86_64
type:           libreport

Potential duplicate: bug 1379278

Comment 1 Lukas Slebodnik 2016-11-26 18:01:58 UTC

IMHO, It should be fixed in container-selinux

Comment 2 Lukas Slebodnik 2016-11-26 18:06:01 UTC

AVCs in permissive mode

sh# systemctl start rhel-push-plugin.service

sh# ausearch -m avc -ts recent -i
type=AVC msg=audit(11/26/2016 19:03:02.610:708) : avc:  denied  { create } for  pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(11/26/2016 19:03:02.610:709) : avc:  denied  { setopt } for  pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(11/26/2016 19:03:02.610:710) : avc:  denied  { bind } for  pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(11/26/2016 19:03:02.610:711) : avc:  denied  { listen } for  pid=1 comm=systemd path=/run/docker/plugins/rhel-push-plugin.sock scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1

sh#  ps auxZ | grep rhel-push-plugi[n]
system_u:system_r:unconfined_service_t:s0 root 7444 0.0  0.0 39488 7052 ?      Ssl  19:03   0:00 /usr/libexec/docker/rhel-push-plugin

Comment 3 Lukas Slebodnik 2016-11-26 18:06:42 UTC

See also BZ1398860

Comment 4 Antonio Murdaca 2016-11-27 11:37:32 UTC

having the same issue here on Rawhide, setenforce 0 makes this work again.

Comment 5 Daniel Walsh 2016-11-27 12:02:20 UTC

9de00853d884e47bae70ea6bc8b87ce1b4a2bab2 should fix this labeling issue in container-selinux package.

Can you push a new docker package with this fix.

Comment 6 Antonio Murdaca 2016-11-27 12:46:50 UTC

rebuilt with the above container-selinux commit: http://koji.fedoraproject.org/koji/buildinfo?buildID=820619

Comment 7 Lukas Slebodnik 2016-11-28 09:52:23 UTC

I still can see AVCs with the latest version

sh# rpm -q docker container-selinux
docker-1.12.3-24.git7b5044b.fc26.x86_64
container-selinux-1.12.3-24.git7b5044b.fc26.x86_64

sh# systemctl start rhel-push-plugin.service
A dependency job for rhel-push-plugin.service failed. See 'journalctl -xe' for details.

[root@graviton ~]# ausearch -m avc -ts recent -i
----
type=AVC msg=audit(11/28/2016 10:51:04.218:274) : avc:  denied  { create } for  pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=0


and in permissive mode
type=AVC msg=audit(11/28/2016 10:51:57.911:278) : avc:  denied  { create } for  pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(11/28/2016 10:51:57.911:279) : avc:  denied  { setopt } for  pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(11/28/2016 10:51:57.911:280) : avc:  denied  { bind } for  pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1 
----
type=AVC msg=audit(11/28/2016 10:51:57.911:281) : avc:  denied  { listen } for  pid=1 comm=systemd path=/run/docker/plugins/rhel-push-plugin.sock scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=1

Comment 8 Antonio Murdaca 2016-11-28 10:07:50 UTC

So, by installing the latest rawhide build on a fresh rawhide vm:

[root@rawhide ~]# ls -laZ /run/docker/plugins/
total 0
drwxr-xr-x. 2 root root system_u:object_r:var_run_t:s0  60 Nov 28 10:03 .
drwxr-xr-x. 5 root root system_u:object_r:var_run_t:s0 100 Nov 28 10:03 ..
srw-rw-rw-. 1 root root system_u:object_r:var_run_t:s0   0 Nov 28 10:03 rhel-push-plugin.sock

Note, it's labeled "var_run_t". BTW, I can successfully start docker and/or the rhel-push-plugin.

Try:

$ restorecon -vR /var/run/docker/plugins

It should give you the correct label for sockets "container_plugin_var_run_t":

[root@rawhide ~]# ls -laZ /run/docker/plugins/
total 0
drwxr-xr-x. 2 root root system_u:object_r:container_plugin_var_run_t:s0  60 Nov 28 10:03 .
drwxr-xr-x. 5 root root system_u:object_r:var_run_t:s0                  100 Nov 28 10:03 ..
srw-rw-rw-. 1 root root system_u:object_r:container_plugin_var_run_t:s0   0 Nov 28 10:03 rhel-push-plugin.sock

Dan, do you know why container-selinux isn't labeling files properly on installation?

Comment 9 Lukas Slebodnik 2016-11-28 10:29:45 UTC

(In reply to Antonio Murdaca from comment #8)
> So, by installing the latest rawhide build on a fresh rawhide vm:
> 
> [root@rawhide ~]# ls -laZ /run/docker/plugins/
> total 0
> drwxr-xr-x. 2 root root system_u:object_r:var_run_t:s0  60 Nov 28 10:03 .
> drwxr-xr-x. 5 root root system_u:object_r:var_run_t:s0 100 Nov 28 10:03 ..
> srw-rw-rw-. 1 root root system_u:object_r:var_run_t:s0   0 Nov 28 10:03
> rhel-push-plugin.sock
> 
> Note, it's labeled "var_run_t". BTW, I can successfully start docker and/or
> the rhel-push-plugin.
> 
That's not the problem. I have correct labels
[root@graviton ~]# ls -laZ /run/docker/plugins/
total 0
drwxr-xr-x. 2 root root system_u:object_r:container_plugin_var_run_t:s0  60 Nov 28 10:51 .
drwx------. 6 root root system_u:object_r:container_var_run_t:s0        120 Nov 28 10:53 ..
srw-rw-rw-. 1 root root system_u:object_r:container_plugin_var_run_t:s0   0 Nov 28 10:51 rhel-push-plugin.sock

Comment 10 Antonio Murdaca 2016-11-28 10:34:11 UTC

(In reply to Lukas Slebodnik from comment #9)
> (In reply to Antonio Murdaca from comment #8)
> > So, by installing the latest rawhide build on a fresh rawhide vm:
> > 
> > [root@rawhide ~]# ls -laZ /run/docker/plugins/
> > total 0
> > drwxr-xr-x. 2 root root system_u:object_r:var_run_t:s0  60 Nov 28 10:03 .
> > drwxr-xr-x. 5 root root system_u:object_r:var_run_t:s0 100 Nov 28 10:03 ..
> > srw-rw-rw-. 1 root root system_u:object_r:var_run_t:s0   0 Nov 28 10:03
> > rhel-push-plugin.sock
> > 
> > Note, it's labeled "var_run_t". BTW, I can successfully start docker and/or
> > the rhel-push-plugin.
> > 
> That's not the problem. I have correct labels
> [root@graviton ~]# ls -laZ /run/docker/plugins/
> total 0
> drwxr-xr-x. 2 root root system_u:object_r:container_plugin_var_run_t:s0  60
> Nov 28 10:51 .
> drwx------. 6 root root system_u:object_r:container_var_run_t:s0        120
> Nov 28 10:53 ..
> srw-rw-rw-. 1 root root system_u:object_r:container_plugin_var_run_t:s0   0
> Nov 28 10:51 rhel-push-plugin.sock

well, it is an issue, at least on my virtual machine :) where I can successfully install and run docker w/o this denials you're having.

Comment 11 Lukas Slebodnik 2016-11-28 10:35:31 UTC

I've just realized that SELinux context was changed in binaries.
Following command fixed the AVCs

sh# restorecon -Rv /usr/libexec/docker/

Comment 12 Daniel Walsh 2016-11-28 13:56:09 UTC

We should add this command to the container-selinux post install script, to make sure its content gets labeled correctly.

Comment 13 Antonio Murdaca 2016-11-28 14:05:53 UTC

(In reply to Daniel Walsh from comment #12)
> We should add this command to the container-selinux post install script, to
> make sure its content gets labeled correctly.

Dan, do you mean something like this? https://paste.fedoraproject.org/491982/34191314/

Note, that restorecon will be run only on "installation" (not on upgrades)

Comment 14 Lukas Slebodnik 2016-12-07 12:25:13 UTC

Description of problem:
systemctl start rpcbind.service

Version-Release number of selected component:
selinux-policy-3.13.1-227.fc26.noarch

Additional info:
reporter:       libreport-2.8.0
hashmarkername: setroubleshoot
kernel:         4.8.11-300.fc25.x86_64
type:           libreport

Comment 15 Antonio Murdaca 2016-12-10 08:26:24 UTC

(In reply to Antonio Murdaca from comment #13)
> (In reply to Daniel Walsh from comment #12)
> > We should add this command to the container-selinux post install script, to
> > make sure its content gets labeled correctly.
> 
> Dan, do you mean something like this?
> https://paste.fedoraproject.org/491982/34191314/
> 
> Note, that restorecon will be run only on "installation" (not on upgrades)

Dan, what do we need to do here? Is it OK to relate files under libexec as I pointed out above?

Comment 16 Daniel Walsh 2016-12-10 12:25:59 UTC

Created attachment 1230250 [details]
This patch should cause docker.rpm to relabel /usr/bin/docker* and /usr/libexec/docker

Comment 17 Daniel Walsh 2016-12-10 12:27:00 UTC

Antonio yes you can relabel the files under /usr/libexec/docker

Which I do in the patch above.

Comment 18 Fedora Update System 2016-12-10 17:35:55 UTC

docker-1.12.3-15.git0423d89.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-37c2c59240

Comment 19 Fedora Update System 2016-12-11 03:30:28 UTC

docker-1.12.3-15.git0423d89.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-37c2c59240

Comment 20 Fedora Update System 2016-12-13 15:04:09 UTC

docker-1.12.4-2.git1b5971a.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-bb5ee53c0a

Comment 21 Fedora Update System 2016-12-13 21:46:54 UTC

docker-1.12.4-5.git1b5971a.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-2a18b9e056

Comment 22 Fedora Update System 2016-12-14 02:25:15 UTC

docker-1.12.4-2.git1b5971a.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-bb5ee53c0a

Comment 23 Fedora Update System 2016-12-14 15:32:29 UTC

docker-1.12.4-6.git1b5971a.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-44ed3dd527

Comment 24 Fedora Update System 2016-12-14 21:30:53 UTC

docker-1.12.4-2.git1b5971a.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 25 Fedora Update System 2016-12-15 05:08:22 UTC

docker-1.12.4-6.git1b5971a.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-44ed3dd527

Comment 26 Fedora Update System 2016-12-16 00:27:25 UTC

docker-1.12.4-6.git1b5971a.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 27 Stephen Gallagher 2017-02-06 13:18:29 UTC

Reopening: this issue is still happening on a fully-updated Rawhide system:

selinux-policy-3.13.1-236.fc26.noarch
docker-1.12.6-17.git037a2f5.fc26.x86_64

Comment 28 Daniel Walsh 2017-02-06 13:32:35 UTC

Stephen could you please attach the AVC's you are seeing?  I am not sure you are seeing the same issue?

ps -eZ | grep docker

Comment 29 Stephen Gallagher 2017-02-06 13:40:41 UTC

Created attachment 1248040 [details]
AVCs

(In reply to Daniel Walsh from comment #28)
> Stephen could you please attach the AVC's you are seeing?  I am not sure you
> are seeing the same issue?
> 
> ps -eZ | grep docker

system_u:system_r:unconfined_service_t:s0 1843 ? 00:00:00 docker-containe
system_u:system_r:unconfined_service_t:s0 1849 ? 00:00:01 dockerd-current



Attached is the output of `audit2why -a` on my system.

It may well not be the same bug, but SELinux Troubleshooter keeps marking it as a dupe, so there could well be a bug in that program as well...

Comment 30 Daniel Walsh 2017-02-06 14:24:11 UTC

This means container-selinux or something did not successfully install.

dnf reinstall container-selinux

If this does not fail then see if a relabel of /usr/bin/docker* works.

restorecon -v /usr/bin/docker*

Comment 31 Daniel Walsh 2017-02-06 14:25:02 UTC

Also restart the docker and docker-containerd service after the relabel.

Comment 32 Fedora End Of Life 2017-02-28 10:40:07 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.

Comment 33 Mirek Svoboda 2017-05-29 20:02:52 UTC

Description of problem:
upgrade from FC25 to FC26
then running dnf update caused this issue

Version-Release number of selected component:
selinux-policy-3.13.1-224.fc25.noarch

Additional info:
reporter:       libreport-2.9.1
hashmarkername: setroubleshoot
kernel:         4.11.0-2.fc26.x86_64
type:           libreport

Comment 34 Eugene Murray 2017-07-27 14:18:41 UTC

Description of problem:
sudo dnf update -y

Version-Release number of selected component:
selinux-policy-3.13.1-224.fc25.noarch

Additional info:
reporter:       libreport-2.9.1
hashmarkername: setroubleshoot
kernel:         4.11.11-300.fc26.x86_64
type:           libreport

Comment 35 matthew gatto 2017-07-28 17:42:29 UTC

Description of problem:
It just happened in day to day use. I've only been using the web browser and doing normal system updates on Fedora 26.

Version-Release number of selected component:
selinux-policy-3.13.1-224.fc25.noarch

Additional info:
reporter:       libreport-2.9.1
hashmarkername: setroubleshoot
kernel:         4.11.11-300.fc26.x86_64
type:           libreport

Comment 36 Fedora End Of Life 2018-05-03 08:18:30 UTC

This message is a reminder that Fedora 26 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 26. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '26'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 26 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Comment 37 Fedora End Of Life 2018-05-29 11:30:23 UTC

Fedora 26 changed to end-of-life (EOL) status on 2018-05-29. Fedora 26
is no longer maintained, which means that it will not receive any
further security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.