Bug 1512783

Description of problem:

Version-Release number of selected component (if applicable):

docker (Release: 26.gitb5e3294.fc27)
selinux-policy-targeted (Release: 283.14.fc27)
iptables 1.6.1


How reproducible:
deterministic / always

Problem: Embedded DNS doesn't work since docker can't set up the required iptables rules.
Workaround: manual setup of iptables / firewalld.
Fix: Change the selinux policy as below (probably to unspecific)

Steps to Reproduce:

1. Configure Docker to use SELinux and user namespaces in /etc/sysconfig/docker with OPTIONS='--selinux-enabled --log-driver=journald --userns-remap="dockremap:dockremap"'

2. create docker-compose.yml with a nginx reverse proxy container and a nginx test container named "nginx1" which is used as upstream in the proxy. 

3. docker-compose up fails in starting the reverse proxy with the following error "nginx: [emerg] host not found in upstream "nginx1" in /etc/nginx.conf..."

4. "journalctl -u docker" shows 
 dockerd-current TIMESTAMP level=error msg="setting up rule failed, [-t nat -I DOCKER_OUTPUT -d 127.0.0.11 -p udp --dport 53 -j DNAT --to-destination 127.0.0.11:49285]"
 dockerd-current TIMESTAMP  level=error msg="setting up rule failed, [-t nat -I DOCKER_POSTROUTING -s 127.0.0.11 -p udp --sport 49285 -j SNAT --to-source :53]"
 dockerd-current TIMESTAMP  level=error msg="setting up rule failed, [-t nat -I DOCKER_OUTPUT -d 127.0.0.11 -p tcp --dport 53 -j DNAT --to-destination 127.0.0.11:33531]"
 dockerd-current TIMESTAMP  level=error msg="setting up rule failed, [-t nat -I DOCKER_POSTROUTING -s 127.0.0.11 -p tcp --sport 33531 -j SNAT --to-source :53]"

5. "ausearch -m avc -ts recent" shows 
> type=AVC msg=audit(1510635119.652:3303): avc:  denied  { net_raw } for  pid=14264 comm="iptables" capability=13 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:iptables_t:s0 tclass=cap_userns permissive=0

6. "grep iptables /var/log/audit/audit.log | audit2allow -M firewall" and "semodule -i firewall.pp" only helps a bit. New aursearch log shows:

> type=AVC msg=audit(1510635770.377:3714): avc:  denied  { net_admin } for  pid=15826 comm="iptables" capability=12 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:system_r:iptables_t:s0 tclass=cap_userns permissive=0 

7. "grep iptables /var/log/audit/audit.log | audit2allow -M firewall2" and "semodule -i firewall2.pp" fixes the problem. The containers work as expected since docker sets up the required masquerading for the embedded dns.