Bug 1811876

Summary: SElinux is preventing my container to mount tmpfs
Product: [Fedora] Fedora Reporter: louisgtwo
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 31CC: dwalsh, grepl.miroslav, lvrabec, plautrba, vmojzis, zpytela
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-10 12:39:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description louisgtwo 2020-03-10 02:40:26 UTC
I'm trying to setup a docker container pducharme/unifi-video-controller on fedora 31. SElinux is preventing this container to mount. With selinux set to permissive the container runs fine.

time->Mon Mar  9 22:31:34 2020
type=AVC msg=audit(1583807494.146:39157): avc:  denied  { mount } for  pid=1744176 comm="mount" name="/" dev="tmpfs" ino=6140956 scontext=system_u:system_r:container_t:s0:c392,c980 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=0
time->Mon Mar  9 22:31:34 2020
type=AVC msg=audit(1583807494.146:39158): avc:  denied  { mount } for  pid=1744176 comm="mount" name="/" dev="tmpfs" ino=6140957 scontext=system_u:system_r:container_t:s0:c392,c980 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=0

Comment 1 Daniel Walsh 2020-03-10 12:39:55 UTC
The Container must be attempting to execute a mount command?  This would be blocked by SELinux as well as CAP_SYS_ADMIN capability.
Most likely you would need to run this container without these protections.

podman run --security-opt label=disable --cap-add CAP_SYS_ADMIN ...