| Summary: | Upgrade to RHEL Atomic 7.3.1 breaks the sshd authentication via SSSD | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Tibor Dudlák <tdudlak> | |
| Component: | docker | Assignee: | Lokesh Mandvekar <lsm5> | |
| Status: | CLOSED ERRATA | QA Contact: | atomic-bugs <atomic-bugs> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 7.3 | CC: | adimania, admiller, amurdaca, dwalsh, extras-qa, ichavero, jcajka, jchaloup, jpazdziora, lslebodn, lsm5, lsu, marianne, miminar, nalin, riek, tdudlak, vbatts | |
| Target Milestone: | rc | Keywords: | Extras, Regression | |
| Target Release: | --- | Flags: | jpazdziora:
needinfo?
(lsm5) jpazdziora: needinfo? (lsu) jpazdziora: needinfo? (lsm5) |
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | 1337856 | |||
| : | 1415113 (view as bug list) | Environment: | ||
| Last Closed: | 2017-01-17 20:44:18 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Bug Depends On: | 1337856 | |||
| Bug Blocks: | 1415113, 1595542 | |||
|
Description
Tibor Dudlák
2016-12-09 14:52:24 UTC
The problem here is sssd is not running as spc_t? It should not be running as container_runtime_t:s0 Is this actually happening in RHEL or is this just happening in Fedora? Both. This bugzilla is a clone of the original Fedora report, to track the fix specifically against RHEL. if you run docker run --privileged fedora cat /proc/self/attr/cuttent What do you see? On Rawhide I am seeing docker run --rm --privileged fedora cat /proc/self/attr/current system_u:system_r:spc_t:s0 -bash-4.2# rpm-ostree status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.3.1 (2016-11-30 02:14:24)
Commit: 42cfe1ca3305defb16dfd59cd0be5c539f19ea720dba861ed11e13941423ae86
OSName: rhel-atomic-host
-bash-4.2# docker run --rm --privileged fedora:24 cat /proc/self/attr/current
system_u:system_r:container_runtime_t:s0
This means that their is no transition happening, and privileged containers are running as the same label as docker. What back end are you seeing this with? On Rawhide I see these rules. sesearch -T -s container_runtime_t -c process | grep spc_t type_transition container_runtime_t container_var_lib_t : process spc_t; type_transition container_runtime_t container_share_t : process spc_t; type_transition container_runtime_t container_file_t : process spc_t; Is /var/lib/docker mounted NOSUID? -bash-4.2# rpm-ostree status
State: idle
Deployments:
● rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.3.1 (2016-11-30 02:14:24)
Commit: 42cfe1ca3305defb16dfd59cd0be5c539f19ea720dba861ed11e13941423ae86
OSName: rhel-atomic-host
-bash-4.2# mount -l | grep var
/dev/mapper/atomicos-root on /var type xfs (rw,relatime,seclabel,attr2,inode64,noquota)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
restorecon -R -v /var/lib/docker Do anything? -bash-4.2# restorecon -R -v /var/lib/docker restorecon reset /var/lib/docker/containers/6192c9e5b08be21af3856a4a89be924898803eb42ffd1d4c421f00dc3d11064d/6192c9e5b08be21af3856a4a89be924898803eb42ffd1d4c421f00dc3d11064d-json.log context system_u:object_r:container_var_lib_t:s0->system_u:object_r:container_log_t:s0 -bash-4.2# docker run --rm --privileged fedora:24 cat /proc/self/attr/current system_u:system_r:container_runtime_t:s0 BTW, It works well with AH 7.3. So it's a regression in Atomic Host
-bash-4.2# rpm-ostree status
State: idle
Deployments:
● rhel7-atomic:rhel-atomic-host/7/x86_64/standard
Version: 7.3 (2016-10-26 14:24:09)
Commit: 90c9735becfff1c55c8586ae0f2c904bc0928f042cd4d016e9e0e2edd16e5e97
OSName: rhel7-atomic
-bash-4.2# docker run --rm --privileged fedora cat /proc/self/attr/current
system_u:system_r:spc_t:s0-bash-4.2#
There is a missing transition rule for container_runtime_t@unlabeled_t->spc_t. This rule is being removed from Fedora but should have been left in for RHEL. https://github.com/projectatomic/container-selinux/commit/cc14935f9a5ee1977b853dc85b3dd4ba3a16d320 Lokesh we need a new build for RHEL including this change. Move to verified with container-selinux-1.12.5-9.el7.x86_64 # sesearch --allow -s sshd_t -t spc_t -p connectto Found 1 semantic av rules: allow domain spc_t : unix_stream_socket connectto ; # sesearch -T -s container_runtime_t -c process | grep spc_t type_transition container_runtime_t container_var_lib_t : process spc_t; type_transition container_runtime_t container_share_t : process spc_t; type_transition container_runtime_t unlabeled_t : process spc_t; (In reply to Luwen Su from comment #25) > Move to verified with container-selinux-1.12.5-9.el7.x86_64 Did you also verify the functionality of authentication itself? Moving back to ON_QA for full verification of comment 0. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2017-0116.html |