Bug 1672891
| Summary: | Many many AVCs from rootless podman on a system with unconfined disabled | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Robin Powell <rlpowell> |
| Component: | container-selinux | Assignee: | Lokesh Mandvekar <lsm5> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 29 | CC: | amurdaca, dwalsh, fkluknav, jchaloup, lsm5, lvrabec, mgrepl, plautrba, rlpowell, zpytela |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | container-selinux-2.82-1.git5e1f62f.fc29 container-selinux-2.82-1.git5e1f62f.fc28 container-selinux-2.95-1.gite3ebc68.fc30 container-selinux-2.95-1.gite3ebc68.fc29 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-04-13 00:03:51 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Robin Powell
2019-02-06 06:52:16 UTC
Hmm. Looking and what audit2allow comes up with, I wonder if it isn't so much "rootless podman doesn't work" as "rootless podman doesn't work as staff_t". Makes sense. Could you please update SELinux denials somewhere else? I cannot access it. I'll do my best to fix it ASAP. I have updated container-selinux to allow transitions from sysadm_t, staff_t and user_t to container runtimes domains. container-selinux-2.82 Moving to container-selinux component then. Thanks, Lukas. container-selinux-2.82-1.git5e1f62f.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2019-ce1a6c2ac9 container-selinux-2.82-1.git5e1f62f.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-b75beee237 container-selinux-2.82-1.git5e1f62f.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-ce1a6c2ac9 container-selinux-2.82-1.git5e1f62f.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-b75beee237 container-selinux-2.82-1.git5e1f62f.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report. container-selinux-2.82-1.git5e1f62f.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report. I'm *really* sorry, I missed the comment that you couldn't see the link I gave. :( Here it is, fixed: http://users.teddyb.org/~rlpowell//media/public/podman_avcs_2019-02-05.txt And here's the one I generated just this morning, with updated everything, running the same command: http://users.teddyb.org/~rlpowell//media/public/podman_avcs_2019-04-04.txt on a host with unconfined disabled. Let me know if you want me to open a new bug, instead. optional_policy(` gen_require(` type sysadm_t, staff_t, user_t; role sysadm_r, staff_r, user_r; ') container_runtime_run(sysadm_t, sysadm_r) role sysadm_r types container_t; role sysadm_r types spc_t; container_runtime_run(staff_t, staff_r) role staff_r types container_t; container_runtime_run(user_t, user_r) role user_r types container_t; ') This policy should have caused a transition from staff_t to container runtime_t when you execute podman Is podman labeled container_runtime_exec_t? Robin, Could you please test suggestion from comment#13 ? # cat local_podman_staff.te policy_module(local_podman_staff, 1.0) optional_policy(` gen_require(` type sysadm_t, staff_t, user_t, container_t, spc_t; role sysadm_r, staff_r, user_r; ') container_runtime_run(sysadm_t, sysadm_r) role sysadm_r types container_t; role sysadm_r types spc_t; container_runtime_run(staff_t, staff_r) role staff_r types container_t; container_runtime_run(user_t, user_r) role user_r types container_t; ') # make -f /usr/share/selinux/devel/Makefile local_podman_staff.pp # semodule -i local_podman_staff.pp Thanks, Lukas. container-selinux-2.95-1.gite3ebc68.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-9e36ddd5a5 container-selinux-2.95-1.gite3ebc68.fc30 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-00c60ff381 container-selinux-2.95-1.gite3ebc68.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-00c60ff381 container-selinux-2.95-1.gite3ebc68.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-9e36ddd5a5 container-selinux-2.95-1.gite3ebc68.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report. container-selinux-2.95-1.gite3ebc68.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report. |