Bug 2211479
| Summary: | avc: denied { name_bind } when pinging from rootless container using pasta network | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Juan Orti <jorti> |
| Component: | container-selinux | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 38 | CC: | amurdaca, dwalsh, dweomer5, jchaloup, lsm5, lvrabec, mmalik, nknazeko, omosnacek, pehunt, pkoncity, rh.container.bot, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | container-selinux-2.218.0-1.fc38 container-selinux-2.218.0-1.fc37 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-06-08 02:03:01 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Tested with:
passt-0^20230509.g96f8d55-1.fc38.x86_64
passt-selinux-0^20230509.g96f8d55-1.fc38.noarch
selinux-policy-38.12-1.fc38.noarch
selinux-policy-targeted-38.12-1.fc38.noarch
● fedora:fedora/x86_64/coreos/stable
Version: 38.20230430.3.1 (2023-05-15T21:32:02Z)
BaseCommit: e7109bec01fdc47125e43fca01b9817d2371557a019bbcfc6a45527c93a23f98
GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464
LayeredPackages: borgbackup borgmatic btrbk passt python3 vim
Switching the component. FEDORA-2023-0e2449e909 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-0e2449e909 FEDORA-2023-a6bd0b248b has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2023-a6bd0b248b FEDORA-2023-d41fad4b7b has been pushed to the Fedora 37 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-d41fad4b7b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d41fad4b7b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2023-f3847c4ae8 has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-f3847c4ae8` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f3847c4ae8 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2023-f3847c4ae8 has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2023-d41fad4b7b has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report. |
Every time that you use ping in a rootless container using --network=pasta I get an AVC. Reproducible: Always Steps to Reproduce: 1. As a non-root user run: podman run --network=pasta -ti --rm fedora:latest bash -c "dnf install -y iputils && ping -c 5 8.8.8.8" Actual Results: We get this AVC: AVC avc: denied { name_bind } for pid=149601 comm="passt.avx2" src=6278 scontext=unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=icmp_socket permissive=0 However, the ping works. Expected Results: No AVC