Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: After last update to selinux-policy-targeted docker stopped to work. Here are just a few examples of various issues. After switching o permissive mode it works. $ docker run -i -t fedora:latest /bin/bash Unable to find image 'fedora:latest' (tag: latest) locally Pulling repository fedora 924a401326b8: Error pulling image (latest) from fedora, exit status 2: tar: ./dev/loop1: Cannot mknod: Permission denied tar: ./dev/loop0: Cannot mknod: Permission denied tar: Exiting with failure status due to previous errors 2014/01/17 11:45:10 Could not find repository on any of the indexed registries. $ docker run centos:latest /bin/bash lxc-start: Permission denied - mount failed '/dev/pts/ptmx'->'/dev/ptmx' lxc-start: failed to setup the new pts instance lxc-start: failed to setup the container lxc-start: invalid sequence number 1. expected 2 lxc-start: failed to spawn '6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/cpuset/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/cpu,cpuacct/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/memory/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/devices/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/freezer/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/net_cls/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/blkio/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/perf_event/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' lxc-start: Device or resource busy - failed to remove cgroup '/sys/fs/cgroup/hugetlb/lxc/6ea71af69a4946e079db0b45d4722579ac445b8c3f62792f141642f68f2e3445' $ docker run -i -t fedora:latest /bin/bash Unable to find image 'fedora:latest' (tag: latest) locally Pulling repository fedora 924a401326b8: Error pulling image (latest) from fedora, permission denied $ grep lxc-start /var/log/audit/audit.log type=SYSCALL msg=audit(1389954552.699:71): arch=c000003e syscall=16 success=yes exit=0 a0=a a1=89a2 a2=7fff74930730 a3=7fff74930550 items=0 ppid=704 pid=832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=SYSCALL msg=audit(1389954552.708:72): arch=c000003e syscall=56 success=yes exit=842 a0=6c020011 a1=7fff74930850 a2=6d a3=7fff749308ac items=0 ppid=704 pid=832 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=AVC msg=audit(1389954552.724:73): avc: denied { mounton } for pid=842 comm="lxc-start" path="/dev/ptmx" dev="dm-3" ino=525205 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file type=SYSCALL msg=audit(1389954552.724:73): arch=c000003e syscall=165 success=no exit=-13 a0=7fbe2fc3b267 a1=7fbe2fc3b296 a2=7fbe2fc39b4b a3=1000 items=0 ppid=0 pid=842 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=SYSCALL msg=audit(1389954965.487:88): arch=c000003e syscall=16 success=yes exit=0 a0=a a1=89a2 a2=7fffbc761920 a3=7fffbc7616e0 items=0 ppid=910 pid=988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=SYSCALL msg=audit(1389954965.496:89): arch=c000003e syscall=56 success=yes exit=998 a0=6c020011 a1=7fffbc761a40 a2=6d a3=7fffbc761a9c items=0 ppid=910 pid=988 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=AVC msg=audit(1389954965.509:90): avc: denied { mounton } for pid=998 comm="lxc-start" path="/dev/ptmx" dev="dm-3" ino=525205 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file type=SYSCALL msg=audit(1389954965.509:90): arch=c000003e syscall=165 success=no exit=-13 a0=7f7a0711c267 a1=7f7a0711c296 a2=7f7a0711ab4b a3=1000 items=0 ppid=0 pid=998 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=SYSCALL msg=audit(1389955068.140:92): arch=c000003e syscall=16 success=yes exit=0 a0=a a1=89a2 a2=7ffff0d33e90 a3=7ffff0d33c50 items=0 ppid=910 pid=1032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=SYSCALL msg=audit(1389955068.149:93): arch=c000003e syscall=56 success=yes exit=1040 a0=6c020011 a1=7ffff0d33fb0 a2=6d a3=7ffff0d3400c items=0 ppid=910 pid=1032 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=AVC msg=audit(1389955068.161:94): avc: denied { mounton } for pid=1040 comm="lxc-start" path="/dev/ptmx" dev="dm-5" ino=525205 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file type=SYSCALL msg=audit(1389955068.161:94): arch=c000003e syscall=165 success=no exit=-13 a0=7fcb56ee0267 a1=7fcb56ee0296 a2=7fcb56edeb4b a3=1000 items=0 ppid=0 pid=1040 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=SYSCALL msg=audit(1389955623.732:61): arch=c000003e syscall=16 success=yes exit=0 a0=a a1=89a2 a2=7fff6721a1e0 a3=7fff67219fa0 items=0 ppid=552 pid=712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=SYSCALL msg=audit(1389955623.743:62): arch=c000003e syscall=56 success=yes exit=724 a0=6c020011 a1=7fff6721a300 a2=6d a3=7fff6721a35c items=0 ppid=552 pid=712 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) type=AVC msg=audit(1389955623.757:63): avc: denied { mounton } for pid=724 comm="lxc-start" path="/dev/ptmx" dev="dm-5" ino=525205 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=chr_file type=SYSCALL msg=audit(1389955623.757:63): arch=c000003e syscall=165 success=yes exit=0 a0=7f741c834267 a1=7f741c834296 a2=7f741c832b4b a3=1000 items=0 ppid=0 pid=724 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts1 comm="lxc-start" exe="/usr/bin/lxc-start" subj=system_u:system_r:docker_t:s0 key=(null) Version-Release number of selected component (if applicable): selinux-policy-targeted-3.12.1-116.fc20.noarch
Miroslav we should make docker an unconfined domain until we can get the SELinux bindings to work in it. This is caused by an unlabled file system being mounted. Once we have the SELinux bindings in, this file system would be mounted with a label like svirt_sandbox_file_t.
commit 4e02271ad7dcd5e1cdbd8655c29cf58609f480fc Author: Miroslav Grepl <mgrepl> Date: Mon Jan 20 10:35:09 2014 +0100 make docker_t as unconfined_t domain
selinux-policy-3.12.1-119.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-119.fc20
Package selinux-policy-3.12.1-119.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-119.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-1249/selinux-policy-3.12.1-119.fc20 then log in and leave karma (feedback).
selinux-policy-3.12.1-119.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.