Bug 1514904

Summary:	SELinux policy is blocking container runtimes from reading /etc/resolv.conf and /etc/hosts
Product:	Red Hat Enterprise Linux 7	Reporter:	Daniel Walsh <dwalsh>
Component:	container-selinux	Assignee:	Lokesh Mandvekar <lsm5>
Status:	CLOSED ERRATA	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	ddarrah
Target Milestone:	rc	Keywords:	Extras
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-30 19:23:40 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Daniel Walsh 2017-11-19 11:29:11 UTC

Some container runtimes mount /etc/resolv.conf and /etc/hosts directly into containers, users could also use -V /etc/resolv.conf:/etc/resolv.conf to bind mount them into containers.  Currently SELinux blocks the reading of these files.  These files are not considered high security targeted and every confined domain is selinux policy is allowed to read these files.  No reason not to allow containers to read them also.

Comment 2 Daniel Walsh 2017-11-19 11:34:45 UTC

Fixed in container-selinux-2.33-1.git86f33cd.el7

Comment 7 errata-xmlrpc 2017-11-30 19:23:40 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:3366