Bug 1698064

Summary: OpenStack undercloud - container AVC denials
Product: Red Hat Enterprise Linux 8 Reporter: Lon Hohberger <lhh>
Component: container-selinuxAssignee: Jindrich Novy <jnovy>
Status: CLOSED DUPLICATE QA Contact: atomic-bugs <atomic-bugs>
Severity: high Docs Contact:
Priority: unspecified    
Version: 8.0CC: dwalsh, jpichon
Target Milestone: rc   
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-09-01 11:15:45 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Lon Hohberger 2019-04-09 14:30:50 UTC
Description of problem: OpenStack undercloud AVC denials

- logrotate
type=AVC msg=audit(1552836961.077:13028): avc:  denied  { read } for  pid=141597 comm="logrotate" name="heat" dev="vda1" ino=180362972 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=1

- RHSM
type=AVC msg=audit(1552835023.245:3710): avc:  denied  { write } for  pid=75628 comm="dnf" name="rhsm" dev="tmpfs" ino=599 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1552835023.245:3710): avc:  denied  { add_name } for  pid=75628 comm="dnf" name="cert.pid" scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1552835023.245:3710): avc:  denied  { create } for  pid=75628 comm="dnf" name="cert.pid" scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1552835023.245:3710): avc:  denied  { write open } for  pid=75628 comm="dnf" path="/run/rhsm/cert.pid" dev="tmpfs" ino=756492 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1552835023.245:3711): avc:  denied  { ioctl } for  pid=75628 comm="dnf" path="/run/rhsm/cert.pid" dev="tmpfs" ino=756492 ioctlcmd=0x5401 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1552835023.245:3712): avc:  denied  { lock } for  pid=75628 comm="dnf" path="/run/rhsm/cert.pid" dev="tmpfs" ino=756492 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1552835023.245:3713): avc:  denied  { read } for  pid=75628 comm="dnf" name="cert.pid" dev="tmpfs" ino=756492 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1552835023.250:3714): avc:  denied  { remove_name } for  pid=75628 comm="dnf" name="cert.pid" dev="tmpfs" ino=756492 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1552835023.250:3714): avc:  denied  { unlink } for  pid=75628 comm="dnf" name="cert.pid" dev="tmpfs" ino=756492 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1552835025.369:3716): avc:  denied  { write } for  pid=75751 comm="dnf" name="rhsm" dev="tmpfs" ino=599 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1552835025.369:3716): avc:  denied  { add_name } for  pid=75751 comm="dnf" name="cert.pid" scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1552835025.374:3717): avc:  denied  { remove_name } for  pid=75751 comm="dnf" name="cert.pid" dev="tmpfs" ino=757092 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1552835035.321:3732): avc:  denied  { write } for  pid=76057 comm="dnf" name="rhsm" dev="tmpfs" ino=599 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1552835035.321:3732): avc:  denied  { add_name } for  pid=76057 comm="dnf" name="cert.pid" scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1552835035.325:3733): avc:  denied  { remove_name } for  pid=76057 comm="dnf" name="cert.pid" dev="tmpfs" ino=762753 scontext=system_u:system_r:container_t:s0:c120,c542 tcontext=system_u:object_r:rhsmcertd_var_run_t:s0 tclass=dir permissive=1

Comment 1 Lon Hohberger 2019-04-11 15:04:30 UTC
At second look - Cedric pointed out that it's a bit odd that a container is running dnf.

Comment 2 Daniel Walsh 2019-09-01 11:15:45 UTC

*** This bug has been marked as a duplicate of bug 1698065 ***