This site requires JavaScript to be enabled to function correctly, please enable it.
Summary:
Starting docker daemon produces AVC denial about iptables_t and container_runtime_t
Product:
[Fedora] Fedora
Reporter:
Jan Pazdziora <jpazdziora>
Component:
selinux-policy Assignee:
Lukas Vrabec <lvrabec>
Status:
CLOSED
ERRATA
QA Contact:
Fedora Extras Quality Assurance <extras-qa>
Severity:
unspecified
Docs Contact:
Priority:
unspecified
Version:
26 CC:
adimania, admiller, amurdaca, dominick.grift, dwalsh, fkluknav, ichavero, jcajka, jpazdziora, lsm5, lvrabec, marianne, mgrepl, mueller, nalin, plautrba, pmoore, riek, ssekidde, vbatts
Target Milestone:
---
Target Release:
---
Hardware:
Unspecified
OS:
Unspecified
Whiteboard:
Fixed In Version:
selinux-policy-3.13.1-260.1.fc26
Doc Type:
If docs needed, set a value
Doc Text:
Story Points:
---
Clone Of:
Environment:
Last Closed:
2017-07-17 04:51:59 UTC
Type:
Bug
Regression:
---
Mount Type:
---
Documentation:
---
CRM:
Verified Versions:
Category:
---
oVirt Team:
---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:
---
Target Upstream Version:
Embargoed:
Description of problem: Starting docker daemon produces AVC denials like type=AVC msg=audit(1497521828.624:143): avc: denied { read } for pid=2472 comm="iptables" path="net:[4026531961]" dev="nsfs" ino=4026531961 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=file permissive=0 Version-Release number of selected component (if applicable): docker-1.13.1-13.git51eb16e.fc26 container-selinux-2.18-1.fc26 How reproducible: Deterministic. Steps to Reproduce: 1. dnf install -y docker 2. systemctl start docker 3. Check audit.log. Actual results: time->Thu Jun 15 06:17:08 2017 type=AVC msg=audit(1497521828.605:139): avc: denied { read } for pid=2464 comm="iptables" path="net:[4026531961]" dev="nsfs" ino=4026531961 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=file permissive=0 ---- time->Thu Jun 15 06:17:08 2017 type=AVC msg=audit(1497521828.608:140): avc: denied { read } for pid=2466 comm="iptables" path="net:[4026531961]" dev="nsfs" ino=4026531961 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=file permissive=0 ---- time->Thu Jun 15 06:17:08 2017 type=AVC msg=audit(1497521828.623:142): avc: denied { read } for pid=2471 comm="iptables" path="net:[4026531961]" dev="nsfs" ino=4026531961 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=file permissive=0 ---- time->Thu Jun 15 06:17:08 2017 type=AVC msg=audit(1497521828.624:143): avc: denied { read } for pid=2472 comm="iptables" path="net:[4026531961]" dev="nsfs" ino=4026531961 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=file permissive=0 ---- time->Thu Jun 15 06:17:08 2017 type=AVC msg=audit(1497521828.625:145): avc: denied { read } for pid=2473 comm="iptables" path="net:[4026531961]" dev="nsfs" ino=4026531961 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=file permissive=0 ---- time->Thu Jun 15 06:17:08 2017 type=AVC msg=audit(1497521828.626:146): avc: denied { read } for pid=2474 comm="iptables" path="net:[4026531961]" dev="nsfs" ino=4026531961 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=file permissive=0 Expected results: No AVC denial. Additional info: