Bug 1488864

Summary:	Errors Failed to set context ... svirt_sandbox_file_t ... on /var/lib/docker/devicemapper/... and /sys/fs/cgroup/... logged in journal
Product:	Red Hat Enterprise Linux 7	Reporter:	Jan Pazdziora <jpazdziora>
Component:	container-selinux	Assignee:	Lokesh Mandvekar <lsm5>
Status:	CLOSED ERRATA	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	dwalsh, jpazdziora, lsu, mikhail.zabaluev
Target Milestone:	rc	Keywords:	Extras
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-04 19:10:32 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Pazdziora 2017-09-06 11:14:41 UTC

Description of problem:

When running systemd from registry.access.redhat.com/rhel7, oci-systemd-hook logs errors about failures to set context to journal.

Version-Release number of selected component (if applicable):

oci-systemd-hook-0.1.12-1.git1e84754.el7.x86_64
docker-1.12.6-55.gitc4618fb.el7.x86_64
selinux-policy-3.13.1-166.el7_4.4.noarch
container-selinux-2.21-2.gitba103ac.el7.noarch

How reproducible:

Deterministic.

Steps to Reproduce:
1. systemctl start docker
2. docker run -d registry.access.redhat.com/rhel7 /usr/sbin/init
3. journalctl -l | grep 'Failed to set context'

Actual results:

Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /var/lib/docker/devicemapper/mnt/7a5b43492b4305a08bcda37ca40a2532750828a83adc63367f7d705be9295831/rootfs//sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/.: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /var/lib/docker/devicemapper/mnt/7a5b43492b4305a08bcda37ca40a2532750828a83adc63367f7d705be9295831/rootfs//sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/..: Read-only file system
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /var/lib/docker/devicemapper/mnt/7a5b43492b4305a08bcda37ca40a2532750828a83adc63367f7d705be9295831/rootfs//sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/cgroup.clone_children: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /var/lib/docker/devicemapper/mnt/7a5b43492b4305a08bcda37ca40a2532750828a83adc63367f7d705be9295831/rootfs//sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/cgroup.event_control: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /var/lib/docker/devicemapper/mnt/7a5b43492b4305a08bcda37ca40a2532750828a83adc63367f7d705be9295831/rootfs//sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/notify_on_release: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /var/lib/docker/devicemapper/mnt/7a5b43492b4305a08bcda37ca40a2532750828a83adc63367f7d705be9295831/rootfs//sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/cgroup.procs: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /var/lib/docker/devicemapper/mnt/7a5b43492b4305a08bcda37ca40a2532750828a83adc63367f7d705be9295831/rootfs//sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/tasks: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/.: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/..: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/cgroup.clone_children: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/cgroup.event_control: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/notify_on_release: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/cgroup.procs: Operation not supported
Sep 06 05:20:19 machine.example.com oci-systemd-hook[14327]: systemdhook <error>: Failed to set context system_u:object_r:svirt_sandbox_file_t:s0:c359,c405 on /sys/fs/cgroup/systemd/system.slice/docker-dbe43aa3e9926b762bec91a0b6c4862d719039b3a4086213cd6b52748fcee872.scope/tasks: Operation not supported

Expected results:

No errors logged in out-of-box situation.

Additional info:

Since the errors don't actually prevent the container and systemd from running, it's confusing to see them logged. Either the hook shouldn't try those operations at all, or it should ignore those errors and be less verbose if they are only nice-to-have, or if getting that context set is important, the container should not get started at all if setting it fails.

Comment 3 Jan Pazdziora 2017-09-06 11:15:33 UTC

I see the same errors on Fedora 25 as well.

Comment 4 Mikhail Zabaluev 2018-05-01 22:01:13 UTC

May be related to bug 1510139.

Comment 5 Daniel Walsh 2019-01-10 18:24:19 UTC

Should be fixed in current contaner-selinux

Comment 8 Daniel Walsh 2019-05-29 13:01:43 UTC

I think the issue here is oci-systemd-hook is attempting to set the SELinux label on cgroups but the kernel does not support this, I don't know why this gets the read-only error.

Can you try this command with podman?

Comment 10 errata-xmlrpc 2019-06-04 19:10:32 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:1356