Bug 1732578
| Summary: | (selinux-osp-container) Unable to access host directory from within container : getting permission denied | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Pavan <pkesavar> | ||||||||||
| Component: | openstack-selinux | Assignee: | Julie Pichon <jpichon> | ||||||||||
| Status: | CLOSED ERRATA | QA Contact: | Pavan <pkesavar> | ||||||||||
| Severity: | high | Docs Contact: | |||||||||||
| Priority: | high | ||||||||||||
| Version: | 15.0 (Stein) | CC: | alee, amoralej, dmendiza, jpichon, lhh, lvrabec, nkinder, sclewis, scorcora, zcaplovi | ||||||||||
| Target Milestone: | ga | Keywords: | Triaged | ||||||||||
| Target Release: | 15.0 (Stein) | ||||||||||||
| Hardware: | x86_64 | ||||||||||||
| OS: | Linux | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | openstack-selinux-0.8.20-0.20190904140454.936ea4f.el8ost ansible-role-thales-hsm-0.2.1-0.20190906180426.1d88cc9.el8ost | Doc Type: | No Doc Update | ||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2019-09-21 11:24:01 UTC | Type: | Bug | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | |||||||||||||
| Bug Blocks: | 1624491 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Pavan
2019-07-23 19:17:01 UTC
audit2allow output for the first log:
#============= container_t ==============
allow container_t pki_common_t:dir read;
allow container_t pki_common_t:file { execute open read };
audit2allow for the controller log:
#============= svirt_lxc_net_t ==============
allow svirt_lxc_net_t cert_t:dir { relabelto setattr };
allow svirt_lxc_net_t cert_t:file { relabelto setattr };
#!!!! This avc is allowed in the current policy
allow svirt_lxc_net_t svirt_sandbox_file_t:dir relabelto;
#!!!! This avc is allowed in the current policy
allow svirt_lxc_net_t user_tmp_t:file open;
allow svirt_lxc_net_t user_tmp_t:file { relabelto setattr };
allow svirt_lxc_net_t var_lib_t:dir { add_name create relabelfrom setattr write };
allow svirt_lxc_net_t var_lib_t:file { create ioctl open read relabelfrom setattr write };
allow svirt_lxc_net_t var_lib_t:lnk_file { create setattr };
svirt_lxc_net_t appears to be an alias for container_t. pki_common_t and cert_t are both defined in selinux-policy-contrib.
Julie's correct on container_t being an alias for svirt_lxc_net_t.
I think this is allowable:
allow container_t pki_common_t:dir read;
allow container_t pki_common_t:file { execute open read };
I think these are also allowable:
#!!!! This avc is allowed in the current policy # Probably later Fedora version?
allow svirt_lxc_net_t svirt_sandbox_file_t:dir relabelto;
#!!!! This avc is allowed in the current policy # Probably later Fedora version? This is read-only access
allow svirt_lxc_net_t user_tmp_t:file open;
I don't like these at all. These give svirt_lxc_net_t domains - i.e. all containers - write access to files in /etc/pki, /var/lib, and /tmp on the host, whenever they are bind-mounted:
allow svirt_lxc_net_t cert_t:dir { relabelto setattr };
allow svirt_lxc_net_t cert_t:file { relabelto setattr };
allow svirt_lxc_net_t user_tmp_t:file { relabelto setattr };
allow svirt_lxc_net_t var_lib_t:dir { add_name create relabelfrom setattr write };
allow svirt_lxc_net_t var_lib_t:file { create ioctl open read relabelfrom setattr write };
allow svirt_lxc_net_t var_lib_t:lnk_file { create setattr };
It sounds like these plugins need some cleanup or we need to mount the files used by the Barbican container another way.
So: a) /var/lib/docker-puppet needs a label that can be accessed from within containers b) We can allow the first couple of things there c) ... what to do with cert_t? d) ... what to do with user_tmp_t? (In reply to Lon Hohberger from comment #5) > #!!!! This avc is allowed in the current policy # Probably later Fedora > version? Strangely, I see the same 2 notices on a fresh RHEL8, with the following package versions: selinux-policy-3.14.1-61.el8.noarch selinux-policy-targeted-3.14.1-61.el8.noarch Not sure what versions are on the host here? The user_tmp_t AVC denials seem related to a single file that's actually under /etc/, config.pp. Not sure what/how it gets created?
type=AVC msg=audit(1494425221.284:3946): avc: denied { open } for pid=225041 comm="puppet" path="/etc/config.pp" dev="vda2" ino=6660370 scontext=system_u:system_r:svirt_lxc_net_t:s0:c152,c463 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1494425234.138:4062): avc: denied { relabelto } for pid=227574 comm="cp" name="config.pp" dev="vda2" ino=113262756 scontext=system_u:system_r:svirt_lxc_net_t:s0:c199,c215 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1494425248.558:4230): avc: denied { setattr } for pid=229229 comm="cp" name="config.pp" dev="vda2" ino=12608319 scontext=system_u:system_r:svirt_lxc_net_t:s0:c201,c464 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
The cert_t denials mostly seem to have something to do with a README file...?!
type=AVC msg=audit(1494425226.461:3985): avc: denied { relabelto } for pid=226767 comm="cp" name="README" dev="vda2" ino=88081659 scontext=system_u:system_r:svirt_lxc_net_t:s0:c237,c579 tcontext=unconfined_u:object_r:cert_t:s0 tclass=file
type=AVC msg=audit(1494425246.443:4214): avc: denied { setattr } for pid=229163 comm="cp" name="README" dev="vda2" ino=93664 scontext=system_u:system_r:svirt_lxc_net_t:s0:c160,c538 tcontext=unconfined_u:object_r:cert_t:s0 tclass=file
Perhaps that can safely be ignored...? (The plugin cleanup you mentioned?) The others have something to do with Java:
type=AVC msg=audit(1494425246.443:4216): avc: denied { setattr } for pid=229163 comm="cp" name="java" dev="vda2" ino=101215 scontext=system_u:system_r:svirt_lxc_net_t:s0:c160,c538 tcontext=unconfined_u:object_r:cert_t:s0 tclass=dir
type=AVC msg=audit(1494425248.588:4233): avc: denied { relabelto } for pid=229229 comm="cp" name="java" dev="vda2" ino=6663604 scontext=system_u:system_r:svirt_lxc_net_t:s0:c201,c464 tcontext=unconfined_u:object_r:cert_t:s0 tclass=dir
Many of the var_lib_t denials appear related to many other services:
type=AVC msg=audit(1494425236.873:4136): avc: denied { create } for pid=228172 comm="mkdir" name="nova_placement" scontext=system_u:system_r:svirt_lxc_net_t:s0:c283,c857 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
type=AVC msg=audit(1494425234.822:4099): avc: denied { write open } for pid=227724 comm="cp" path="/var/lib/config-data/heat/etc/DIR_COLORS" dev="vda2" ino=25167830 scontext=system_u:system_r:svirt_lxc_net_t:s0:c289,c681 tcontext=system_u:object_r:var_lib_t:s0 tclass=file
type=AVC msg=audit(1494425227.577:3995): avc: denied { write open } for pid=226869 comm="cp" path="/var/lib/config-data/glance_api/etc/DIR_COLORS" dev="vda2" ino=41943518 scontext=system_u:system_r:svirt_lxc_net_t:s0:c369,c443 tcontext=system_u:object_r:var_lib_t:s0 tclass=file
type=AVC msg=audit(1494425211.894:3920): avc: denied { read } for pid=224733 comm="docker-puppet-m" name="docker-puppet-mongodb.sh" dev="vda2" ino=54526155 scontext=system_u:system_r:svirt_lxc_net_t:s0:c783,c1002 tcontext=system_u:object_r:var_lib_t:s0 tclass=file
type=AVC msg=audit(1494425246.388:4202): avc: denied { create } for pid=229162 comm="mkdir" name="gnocchi" scontext=system_u:system_r:svirt_lxc_net_t:s0:c160,c538 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
And also some var_lib_t ld/symlink failures:
type=AVC msg=audit(1494425251.457:4261): avc: denied { create } for pid=229342 comm="cp" name="ld" scontext=system_u:system_r:svirt_lxc_net_t:s0:c859,c898 tcontext=system_u:object_r:var_lib_t:s0 tclass=lnk_file
type=AVC msg=audit(1494425251.457:4262): avc: denied { setattr } for pid=229342 comm="cp" name="ld" dev="vda2" ino=62947241 scontext=system_u:system_r:svirt_lxc_net_t:s0:c859,c898 tcontext=system_u:object_r:var_lib_t:s0 tclass=lnk_file
There's also a bunch of dispatcher.d errors which seem related to NetworkManager but probably should already be covered by the rules under "This avc is allowed in the current policy" mentioned above, e.g.
type=AVC msg=audit(1494425251.130:4243): avc: denied { relabelto } for pid=229305 comm="cp" name="dispatcher.d" dev="vda2" ino=20974255 scontext=system_u:system_r:svirt_lxc_net_t:s0:c410,c840 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c410,c840 tclass=dir
(In reply to Lon Hohberger from comment #6)
> So:
>
> a) /var/lib/docker-puppet needs a label that can be accessed from within
> containers
>
> b) We can allow the first couple of things there
>
> c) ... what to do with cert_t?
>
> d) ... what to do with user_tmp_t?
I am not sure about a) and what creates it, but I wonder if doing b) would be sufficient at this point to resolve the issue with the command that's explicitly mentioned in the description, at least?
Yeah, that sounds like a good, simple plan to start with. Merged upstream; awaiting build Created attachment 1609683 [details]
audit log for setup prrocess
This include setup + restart of container + storing secrets
Created attachment 1609684 [details]
audit log for restarting barbican containers
Just for restarting the barbican_api, barbican_worker, barbican_keystone_listener with podman restart ...
Created attachment 1609685 [details]
audit log for using barbican to store secrets
Container is already running here.
Thank you for the logs. It looks like the cert_t denials that were there before (comment 4 / comment 2) no longer show up? All the rules from the denials in those last 3 logs look like this: #============= chronyd_t ============== allow chronyd_t cloud_init_t:unix_dgram_socket sendto; #============= container_t ============== allow container_t init_t:dbus send_msg; allow container_t initrc_t:unix_stream_socket connectto; allow container_t pki_common_t:dir { add_name remove_name write }; allow container_t pki_common_t:file { append create lock rename write }; allow container_t pki_common_t:sock_file write; allow container_t system_dbusd_t:dbus send_msg; #============= init_t ============== allow init_t container_t:dbus send_msg; I suspect chronyd_t is unrelated and can be safely ignored at this point. The pki_common_t ones are obviously necessary and directly reference /opt/nfast. "allow container_t initrc_t:unix_stream_socket connectto;" seems related to barbican-manage as well. The 3 dbus / systemd are USER_AVCs that seem unrelated to barbican commands. PR is up to add a boolean that is off-by-default and adds the permissions above: https://github.com/redhat-openstack/openstack-selinux/pull/39 As discussed on IRC on Friday, the boolean will need to be enabled during the installation process for that plug-in. If in THT, there are some examples on how to do that (e.g. https://opendev.org/openstack/tripleo-heat-templates/src/branch/master/deployment/logrotate/logrotate-crond-container-puppet.yaml#L75) Requires: https://review.opendev.org/#/c/680419/ This has a correlative fix in ansible-role-thales-hsm --- moving to POST. The build is now available: ansible-role-thales-hsm-0.2.1-0.20190905145234.1b2df10.el8ost Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2019:2811 |