Bug 1122434 - docker-io denied by selinux
Summary: docker-io denied by selinux
Alias: None
Product: Fedora
Classification: Fedora
Component: docker-io
Version: 19
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Lokesh Mandvekar
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2014-07-23 08:57 UTC by David Busby
Modified: 2014-08-23 01:54 UTC (History)
11 users (show)

Fixed In Version: docker-io-1.1.2-3.fc19
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-08-23 01:54:31 UTC

Attachments (Terms of Use)

Description David Busby 2014-07-23 08:57:56 UTC
Description of problem:

A docker run will fail with permission denied

Version-Release number of selected component (if applicable):


How reproducible:

sudo docker run -t -i ubuntu /bin/bash

Steps to Reproduce:
1. sudo docker run -t -i ubuntu /bin/bash
2. 2014/07/23 08:55:21 permission denied

Actual results:

Permission denied

Expected results:

shell inside ubuntu container

Additional info:

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that dockerinit-1.0.0 should be allowed transition access on processes labeled svirt_lxc_net_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# grep dockerinit-1.0. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:initrc_t:s0
Target Context                system_u:system_r:svirt_lxc_net_t:s0:c198,c908
Target Objects                /bin/bash [ process ]
Source                        dockerinit-1.0.
Source Path                   /var/lib/docker/init/dockerinit-1.0.0
Port                          <Unknown>
Host                          icleus-oneiroi-co-uk
Source RPM Packages           
Target RPM Packages           bash-4.2.47-1.fc19.x86_64
Policy RPM                    selinux-policy-3.12.1-74.26.fc19.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     icleus-oneiroi-co-uk
Platform                      Linux icleus-oneiroi-co-uk 3.14.8-100.fc19.x86_64
                              #1 SMP Mon Jun 16 21:53:59 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-07-23 09:55:21 BST
Last Seen                     2014-07-23 09:55:21 BST
Local ID                      ebf8fa7f-3629-4814-880f-e88a3cbeae4d

Raw Audit Messages
type=AVC msg=audit(1406105721.713:546): avc:  denied  { transition } for  pid=24404 comm="dockerinit-1.0." path="/bin/bash" dev="dm-6" ino=525244 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c198,c908 tclass=process

type=SYSCALL msg=audit(1406105721.713:546): arch=x86_64 syscall=execve success=no exit=EACCES a0=c2100bbb70 a1=c2100bbb80 a2=c2100ba1e0 a3=0 items=0 ppid=20874 pid=24404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=4294967295 comm=dockerinit-1.0. exe=/var/lib/docker/init/dockerinit-1.0.0 subj=system_u:system_r:initrc_t:s0 key=(null)

Hash: dockerinit-1.0.,initrc_t,svirt_lxc_net_t,process,transition

Comment 1 Justin Clift 2014-08-04 17:23:26 UTC
This problem happens here as well, on F19, when following the docker website instructions for verifying a good install.

Creating and loading the TE policy as suggested by audit2allow doesn't fix the problem.

As an interesting data point, the problem only occurs when docker is started using systemctl.  If docker is started manually ("sudo docker -D -d") then the docker client command works fine, and the expected bash shell launches.

Note, this is completely reproduce-able, and the behaviour occurs across reboots.  So, not a transient error.

Comment 2 Lokesh Mandvekar 2014-08-04 17:49:49 UTC
docker 1.1.2 is available in the testing repos. Could you check if this problem still occurs with it? Works well for me on fedora rawhide.

Comment 3 Justin Clift 2014-08-04 18:51:34 UTC
Thanks Lokesh.  Tried that, but no change.  Still has the same problem.

Comment 4 Daniel Walsh 2014-08-05 12:14:11 UTC
selinux-enabled should not be set on Fedora 19, since the policy has not been back ported.

Comment 5 Lokesh Mandvekar 2014-08-05 14:58:49 UTC
Ack, thanks Dan. I'll create a new build without selinux for f19

Comment 6 Fedora Update System 2014-08-05 15:55:50 UTC
docker-io-1.1.2-3.fc19 has been submitted as an update for Fedora 19.

Comment 7 Justin Clift 2014-08-05 17:15:18 UTC
Yep, that seems to have fixed it.  The bash prompt example now works with docker started through systemd.

Comment 8 Fedora Update System 2014-08-07 15:28:14 UTC
Package docker-io-1.1.2-3.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing docker-io-1.1.2-3.fc19'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).

Comment 9 Fedora Update System 2014-08-23 01:54:31 UTC
docker-io-1.1.2-3.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.