Bug 2132229

Summary: [RHEL8.6/Insights/SELinux/Bug] SELinux AVC insights-client with podman containers running
Product: Red Hat Enterprise Linux 8 Reporter: Nikhil Gupta <ngupta>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: low Docs Contact: Mirek Jahoda <mjahoda>
Priority: medium    
Version: 8.6CC: jafiala, lvrabec, mmalik, nknazeko, pakotvan, peter.vreman
Target Milestone: rcKeywords: Triaged
Target Release: 8.8Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-16 09:04:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nikhil Gupta 2022-10-05 07:25:38 UTC
Description of problem:
SELinux AVC insights-client with podman containers running
~~~
allow insights_client_t container_ro_file_t:blk_file { create unlink };
allow insights_client_t container_ro_file_t:dir { add_name mounton remove_name write };
allow insights_client_t container_ro_file_t:file write;
allow insights_client_t container_runtime_t:fifo_file getattr;
allow insights_client_t container_runtime_tmpfs_t:file write;

#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow insights_client_t container_runtime_tmpfs_t:file map;
allow insights_client_t container_t:fifo_file getattr;
allow insights_client_t container_var_lib_t:file write;

#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow insights_client_t container_var_lib_t:file map;
allow insights_client_t container_var_run_t:file write;
allow insights_client_t etc_t:file write;
allow insights_client_t fs_t:filesystem quotamod;
allow insights_client_t self:capability mknod;
~~~

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 Zdenek Pytela 2022-10-05 08:05:54 UTC
I suppose all of the denials should be resolved in current policy version because:

rhel87# sesearch -T -s insights_client_t -t container_runtime_exec_t
type_transition insights_client_t container_runtime_exec_t:process container_runtime_t;

Comment 11 errata-xmlrpc 2023-05-16 09:04:16 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2965