Bug 1637773

Summary:	A SELinux definition to /var/lib/registry is missing
Product:	Red Hat Enterprise Linux 7	Reporter:	Keigo Noha <knoha>
Component:	container-selinux	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED ERRATA	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	high	Docs Contact:
Priority:	medium
Version:	7.6	CC:	dornelas, dwalsh, knoha, lhh, lsu, mgrepl
Target Milestone:	rc	Keywords:	Extras, ZStream
Target Release:	7.7
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	container-selinux-2.79	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-04-23 17:40:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1186913

Description Keigo Noha 2018-10-10 04:23:25 UTC

Description of problem:
Current restore procedure lacks the steps of SELinux labeling to rsynced directories and files.
It causes inconsistency between original node and recovered node.
This inconsistency may cause the issue by SELinux in the future change in undercloud.

c.f. https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html-single/back_up_and_restore_the_director_undercloud/#restore_the_undercloud

As far as I checked, following directories are mapped to usr_tmp_t label.

/var/lib/glance
/var/lib/docker
/var/lib/registry
/var/lib/registry/docker

These directories should be

/var/lib/glance: glance_var_lib_t
/var/lib/docker: container_var_lib_t
/var/lib/registry: var_lib_t
/var/lib/registry/docker: container_var_lib_t

Most of them will be restored with restorecon command but restorecon to /var/lib/registry/docker might not work because predefined selinux policy doesn't exist for /var/lib/registry.

It looks that openstack-selinux policy doesn't have proper context in it
Additional info:

Comment 1 Zoli Caplovic 2018-10-15 15:51:53 UTC

This BZ is for container-selinux group

Comment 2 Derrick Ornelas 2018-10-16 15:14:06 UTC

The /var/lib/registry directory is covered by the following file context rule:

  /var/lib(/.*)?                     all files          system_u:object_r:var_lib_t:s0 


To my knowledge the /var/lib/registry/docker directory does not require container_var_lib_t.  The docker-distribution package, which provides /var/lib/registry, does not require container-selinux, and works correctly without it.  

Are you having an issue with docker-distribution and files marked var_lib_t?

Comment 3 Keigo Noha 2018-10-22 07:31:38 UTC

Hello Derrick,

The context, var_lib_t doesn't have any issue currently.
However, usually user expects that a recovery procedure makes the system recovered as same as when backup is taken.
And current var_lib_t context to /var/lib/registry/docker may not have trouble now but it is not guaranteed in the future.
So, a customer thinks we should add the proper context to /var/lib/registry/docker into container-selinux.

In my opinion, they have a good point. How do you think about it?

Comment 4 Keigo Noha 2018-11-09 00:55:52 UTC

Hello Derrick,

Could you share your thoughts regarding my comment in c#3?
If the issue should be covered by documentation, please let me know.

Best Regards,
Keigo Noha

Comment 7 Daniel Walsh 2019-01-10 20:29:31 UTC

We can change the label of /var/lib/registry to container_var_lib_t

Is that part of the latest docker packages?

Comment 8 Daniel Walsh 2019-01-10 20:31:05 UTC

Fixed in container-selinux-2.79

Comment 9 Keigo Noha 2019-01-17 01:44:47 UTC

Hi Daniel,

Comment 10 Keigo Noha 2019-01-17 01:45:45 UTC

Hi Daniel,

Thank you for your work on this bugzilla.
docker-distribution package creates /var/lib/registry directory.

Regards,
Keigo Noha

Comment 12 Luwen Su 2019-04-12 10:50:04 UTC

container-selinux-2.95-2.el7_6.noarch

#restorecon -R /var/lib/registry/
# ls -Z | grep -i registry
drwxr-xr-x. root    root    system_u:object_r:container_var_lib_t:s0 registry

move to verified.

Comment 14 errata-xmlrpc 2019-04-23 17:40:07 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0861