Bug 2270733
| Summary: | SELinux denial for dhcpcd in /var/run/netns | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Martin Osvald 🛹 <mosvald> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | dwalsh, knazekovan, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-03-21 15:32:08 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 2269708 *** Oh sorry! I forgot to check existing BZs. np, it is quite fresh, not even in a build |
Description of problem: While writing a CI test for Kea I came to notice about SELinux denial for dhcpcd when run under non default network namespace. Dhcpcd tries to detect whether it runs under network namespace and if so it reads the name of it and just prints it for logging/informative purposes. This prevents CI tests to pass cleanly. Version-Release number of selected component (if applicable): selinux-policy-40.15-1.fc41.noarch How reproducible: Always. Steps to Reproduce: 1. run dhcpcd under non-default network namespace # ip netns exec netns-client dhcpcd -4 --inactive -B --nohook 20-resolv.conf veth1 Actual results: ~~~ [ ERROR ] AVC check: FAIL ---- type=AVC msg=audit(03/21/2024 10:44:52.504:650) : avc: denied { read } for pid=3762 comm=dhcpcd name=netns dev="tmpfs" ino=1407 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:ifconfig_var_run_t:s0 tclass=dir permissive=0 ~~~ Expected results: No denials. Additional info: strace: 6569 10:47:50.521190 openat(AT_FDCWD</>, "/var/run/netns", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied) <0.000204> dhcpd code: https://github.com/NetworkConfiguration/dhcpcd/blob/master/src/if-linux.c#L406