Bug 2122239

Summary:	SELinux is preventing ostnamed from remounting container_ro_file_t filesystems
Product:	Red Hat Enterprise Linux 8	Reporter:	Alex Stupnikov <astupnik>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.4	CC:	cmayapka, jnovy, lvrabec, mmalik, tsweeney
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.8
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:	selinux-policy-3.14.3-110.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-16 09:03:52 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alex Stupnikov 2022-08-29 15:04:40 UTC

Description of problem:
When systemd-hostnamed service is restarted or hostnamectl command is issued, the child of systemd (which will later be systemd-hostnamed) remounts all file systems read-only (MS_RDONLY) as per service unit policy (ProtectXXX stanzas). SELinux blocks ostnamed from remounting container_ro_file_t filesystems.


Version-Release number of selected component (if applicable):
RHEL 8.2, RHEL 8.4 (reproduced on both)


How reproducible:
Restart systemd-hostnamed service or issue hostnamectl command on host with podman containers and container_ro_file_t mounts (RHOSP Compute nodes specifically).

Actual results:
SELinux is preventing ostnamed from remounting container_ro_file_t filesystems

Expected results:
SELinux is allowing ostnamed from remounting container_ro_file_t filesystems

Additional info:
Will provide in private follow-up

Comment 3 Zdenek Pytela 2022-09-13 12:25:15 UTC

Commit to backport:
commit e08c435d047d12cf06a4749b963035c34cbb2225
Author: Zdenek Pytela <zpytela>
Date:   Wed Sep 7 09:41:19 2022 +0200

    Allow init remount all file_type filesystems

Comment 11 errata-xmlrpc 2023-05-16 09:03:52 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2965