Bug 1973418
| Summary: | kubelet service fail to load EnvironmentFile due to SELinux denial (Re-opened) | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Michael Nguyen <mnguyen> | |
| Component: | container-selinux | Assignee: | Jindrich Novy <jnovy> | |
| Status: | CLOSED ERRATA | QA Contact: | Edward Shen <weshen> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | urgent | |||
| Version: | 8.4 | CC: | Alexandros.Phinikarides, dornelas, dwalsh, jnovy, lvrabec, miabbott, mmalik, ssekidde, tsweeney, ypu | |
| Target Milestone: | beta | Keywords: | ZStream | |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | container-selinux-2.165.1-2.el8 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1999245 2005018 (view as bug list) | Environment: | ||
| Last Closed: | 2021-11-09 17:38:44 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1186913, 1969998, 1999245, 2005018 | |||
|
Description
Michael Nguyen
2021-06-17 19:06:05 UTC
Simple reproducer:
- create a simple file at /etc/kubernetes/test
```
# cat /etc/kubernetes/test
TEST=foobar
```
- create a simple systemd service with an EnvironmentFile
```
$ systemctl cat echo.service
# /etc/systemd/system/echo.service
[Unit]
Description=An echo unit
[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=/etc/kubernetes/kubelet-pause-image-override
ExecStart=/usr/bin/echo ${PAUSE}
[Install]
WantedBy=multi-user.target
```
- systemd daemon-reload && systemctl start echo.service
```
$ sudo systemctl daemon-reload && sudo systemctl start echo.service
Job for echo.service failed because of unavailable resources or another system error.
See "systemctl status echo.service" and "journalctl -xe" for details.
$ systemctl status echo.service
● echo.service - An echo unit
Loaded: loaded (/etc/systemd/system/echo.service; enabled; vendor preset: enabled)
Active: failed (Result: resources)
Jun 17 19:29:43 localhost systemd[1]: echo.service: Failed to load environment files: Permission denied
Jun 17 19:29:43 localhost systemd[1]: echo.service: Failed to run 'start' task: Permission denied
Jun 17 19:29:43 localhost systemd[1]: echo.service: Failed with result 'resources'.
Jun 17 19:29:43 localhost systemd[1]: Failed to start An echo unit.
```
```
$ sudo audit2allow -a
#============= init_t ==============
allow init_t kubernetes_file_t:file read;
```
(In reply to Micah Abbott from comment #2) > Simple reproducer: > > - create a simple file at /etc/kubernetes/test > > ``` > # cat /etc/kubernetes/test > TEST=foobar > ``` > > - create a simple systemd service with an EnvironmentFile > > ``` > $ systemctl cat echo.service > # /etc/systemd/system/echo.service > [Unit] > Description=An echo unit > [Service] > Type=oneshot > RemainAfterExit=yes > EnvironmentFile=/etc/kubernetes/kubelet-pause-image-override Argh, this line should read: EnvironmentFile=/etc/kubernetes/test > ExecStart=/usr/bin/echo ${PAUSE} > [Install] > WantedBy=multi-user.target > ``` > > - systemd daemon-reload && systemctl start echo.service > > ``` > $ sudo systemctl daemon-reload && sudo systemctl start echo.service > Job for echo.service failed because of unavailable resources or another > system error. > See "systemctl status echo.service" and "journalctl -xe" for details. > > $ systemctl status echo.service > ● echo.service - An echo unit > Loaded: loaded (/etc/systemd/system/echo.service; enabled; vendor preset: > enabled) > Active: failed (Result: resources) > > Jun 17 19:29:43 localhost systemd[1]: echo.service: Failed to load > environment files: Permission denied > Jun 17 19:29:43 localhost systemd[1]: echo.service: Failed to run 'start' > task: Permission denied > Jun 17 19:29:43 localhost systemd[1]: echo.service: Failed with result > 'resources'. > Jun 17 19:29:43 localhost systemd[1]: Failed to start An echo unit. > ``` > > ``` > $ sudo audit2allow -a > > > #============= init_t ============== > allow init_t kubernetes_file_t:file read; > ``` This is an SELinux policy bug not a container-selinux bug. (In reply to Daniel Walsh from comment #4) > This is an SELinux policy bug not a container-selinux bug. Does there need to be some change in selinux-policy in addition to what you added to container-selinux in https://github.com/containers/container-selinux/commit/da2828824807d859cee1ac96e1d39c1abd4397da ? Fixed in container-selinux-2.165.0 FWIW, I built a custom RHCOS 4.9 image using `container-selinux-2.165.1-2.module+el8.5.0+12381+e822eb26.noarch` and confirmed that the issue was fixed using the reproducer:
`
```
[core@cosa-devsh ~]$ rpm-ostree status
State: idle
Deployments:
* ostree://b92a5782851fe87a9e7b4b5647a8bbb571957599609b5a73aea6623a9dcf9576
Version: 49.84.202108261523-0 (2021-08-26T15:25:49Z)
[core@cosa-devsh ~]$ rpm -q container-selinux
container-selinux-2.165.1-2.module+el8.5.0+12381+e822eb26.noarch
[core@cosa-devsh ~]$ systemctl status echo.service
● echo.service - An echo unit
Loaded: loaded (/etc/systemd/system/echo.service; enabled; vendor preset: enabled)
Active: active (exited) since Thu 2021-08-26 15:55:05 UTC; 1min 4s ago
Process: 1360 ExecStart=/usr/bin/echo ${PAUSE} (code=exited, status=0/SUCCESS)
Main PID: 1360 (code=exited, status=0/SUCCESS)
Tasks: 0 (limit: 5610)
Memory: 0B
CGroup: /system.slice/echo.service
Aug 26 15:55:05 localhost systemd[1]: Starting An echo unit...
Aug 26 15:55:05 localhost echo[1360]: registry.fedoraproject.org/fedora:34
Aug 26 15:55:05 localhost systemd[1]: Started An echo unit.
[core@cosa-devsh ~]$ sudo ausearch -m avc
<no matches>
```
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: container-tools:rhel8 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4154 |