Bug 2025445

Which version of container-selinux are you using?

Hi Jindrich,

On worker node I have:

# rpm -q container-selinux
container-selinux-2.167.0-1.module+el8.4.0+12646+b6fd1bdf.noarch

Best Regards,
Chen

Looks to me like the update failed or you are using the old policy.

Can you execute semodule -B to recompile the policy and see if the container-selinux package was updated.

Hi Daniel, Jindrich,

I ran the semodule -B but still the same result. So in theory the 2.171 container-selinux should contain the fix am I correct ?

On worker node:

sh-4.4# rpm -qa | grep container
containernetworking-plugins-0.9.1-1.module+el8.4.0+11822+6cc1e7d7.x86_64
containers-common-1.3.1-5.module+el8.4.0+11990+22932769.x86_64
container-selinux-2.171.0-1.module+el8.5.0+13418+bc0307a5.noarch
sh-4.4# > /var/log/audit/audit.log
sh-4.4# semodule -B

In POD:

sh-4.4# ping -I 10.128.2.24 8.8.8.8
bind: Permission denied

On worker node:

sh-4.4# grep ping /var/log/audit/audit.log
type=AVC msg=audit(1637631198.704:101): avc:  denied  { node_bind } for  pid=3181018 comm="ping" saddr=10.128.2.24 scontext=system_u:system_r:container_t:s0:c13,c407 tcontext=system_u:object_r:node_t:s0 tclass=icmp_socket permissive=0
type=SYSCALL msg=audit(1637631198.704:101): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=55d421d45070 a2=10 a3=7f44cb1d4280 items=0 ppid=3118334 pid=3181018 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4294967295 comm="ping" exe="/usr/bin/ping" subj=system_u:system_r:container_t:s0:c13,c407 key=(null)ARCH=x86_64 SYSCALL=bind AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"

Jindrich either that container-selinux does not have the fix, or something in the coreos update is failing.

Can you just back port the latest container-selinux?

It should not cause any problems.

RHAOS-4.6 and on will have at least container-selinux-2.170.0 in next releases which is reasonably recent (and 2.172.0 in 4.10). But without proper RCA we don't really know if it fixes the problem Chen is seeing or not.

Chen, Prashanth, it might be well a duplicate of the bug you mentioned in comment #16. Reassigning to selinux-policy (where the fix actually landed) to confirm.

Hi Jindrich,

May I know whether the following workaround can be applied to CoreOS worker node ?

sh-4.4# cat /var/log/audit/audit.log | audit2allow

#============= container_t ==============
allow container_t node_t:icmp_socket node_bind;
sh-4.4# cd /tmp/
sh-4.4# cat /var/log/audit/audit.log | audit2allow -M ping_rule
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i ping_rule.pp

sh-4.4# semodule -i ping_rule.pp

Also after applying the ping_rule.pp on CoreOS worker node I can confirm the ping -I <source address> could work inside the POD.

Thank you so much!

Best Regards,
Chen

FYI
-I is for interface
```
# ping --help
ping: invalid option -- '-'
Usage: ping [-aAbBdDfhLnOqrRUvV64] [-c count] [-i interval] [-I interface]
            [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos]
            [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option]
            [-w deadline] [-W timeout] [hop1 ...] destination
Usage: ping -6 [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface]
             [-l preload] [-m mark] [-M pmtudisc_option]
             [-N nodeinfo_option] [-p pattern] [-Q tclass] [-s packetsize]
             [-S sndbuf] [-t ttl] [-T timestamp_option] [-w deadline]
             [-W timeout] destination

```

and that pod definition only have one nic (the primary)..

Hi Yuval,

Thank you for your input.

The POD is just a sample and in customer's scenario the POD will use source based routing so ping -I <source address> is required in customer's scenario.

Best Regards,
Chen

SGTM Chen. Leaving this to Dan/Zdenek to double-confirm.

Backporting the last out of these 3 commits will resolve the reported issue as container_t is corenet_unconfined_type.

commit 1aa9e5609375815103d2445df1746cb90a02b55a
Author: Patrik Koncity <pkoncity>
Date:   Tue Aug 11 14:19:29 2020 +0200

    Allow traceroute_t and ping_t to bind generic nodes.

    Use newly created macro corenet_icmp_bind_generic_node() for ping_t and traceroute_t.
    This macro allowing bind generic nodes in node_t domain.

commit 65c1a66265908f3d5a39fa201d6b6f9f2a2981a4
Author: Patrik Koncity <pkoncity>
Date:   Tue Aug 11 13:51:55 2020 +0200

    Create macro corenet_icmp_bind_generic_node()

    This macro allowing bind ICMP sockets to generic nodes in node_t domain.

commit e4f9c9f4f4c5af851410fde006f6589c0bf7f863
Author: Patrik Koncity <pkoncity>
Date:   Wed Aug 5 17:26:20 2020 +0200

    Allow unconfined_t to node_bind icmp_sockets in node_t domain

    When uncofined user run ping or traceroute, this process get label unconfined_t.
    Allow to ping or traceroute, which run as unconfined_t, to node_bind icmp_sockets in node_t domain.

    Bugzila: https://bugzilla.redhat.com/show_bug.cgi?id=1848929#c0

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:1995

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days