Bug 1123817 - SELinux is preventing /usr/lib/systemd/systemd from 'mounton' accesses on the directory .
Summary: SELinux is preventing /usr/lib/systemd/systemd from 'mounton' accesses on the...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 20
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:8bf437f4b959e43622a86663cb9...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-07-28 10:41 UTC by Yajo
Modified: 2014-07-30 09:00 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-07-28 12:17:28 UTC


Attachments (Terms of Use)

Description Yajo 2014-07-28 10:41:53 UTC
Description of problem:
Execute: docker run --rm -it centos init
SELinux is preventing /usr/lib/systemd/systemd from 'mounton' accesses on the directory .

*****  Plugin catchall (100. confidence) suggests   **************************

If cree que de manera predeterminada, systemd debería permitir acceso mounton sobre   directory.     
Then debería reportar esto como un error.
Puede generar un módulo de política local para permitir este acceso.
Do
permita el acceso momentáneamente executando:
# grep systemd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:svirt_lxc_net_t:s0:c526,c690
Target Context                system_u:object_r:sysfs_t:s0
Target Objects                 [ dir ]
Source                        systemd
Source Path                   /usr/lib/systemd/systemd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-208-20.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-177.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.15.6-200.fc20.x86_64 #1 SMP Fri
                              Jul 18 02:36:27 UTC 2014 x86_64 x86_64
Alert Count                   1
First Seen                    2014-07-28 12:40:40 CEST
Last Seen                     2014-07-28 12:40:40 CEST
Local ID                      938c328c-cf61-4833-9f24-5205c153515b

Raw Audit Messages
type=AVC msg=audit(1406544040.635:507): avc:  denied  { mounton } for  pid=13867 comm="systemd" path="/sys/kernel/security" dev="sysfs" ino=778 scontext=system_u:system_r:svirt_lxc_net_t:s0:c526,c690 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir


type=SYSCALL msg=audit(1406544040.635:507): arch=x86_64 syscall=mount success=no exit=EACCES a0=7f1cc39a22dc a1=7f1cc39a22e7 a2=7f1cc39a22dc a3=e items=0 ppid=832 pid=13867 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=4294967295 comm=systemd exe=/usr/lib/systemd/systemd subj=system_u:system_r:svirt_lxc_net_t:s0:c526,c690 key=(null)

Hash: systemd,svirt_lxc_net_t,sysfs_t,dir,mounton

Additional info:
reporter:       libreport-2.2.3
hashmarkername: setroubleshoot
kernel:         3.15.6-200.fc20.x86_64
type:           libreport

Comment 1 Daniel Walsh 2014-07-28 12:17:28 UTC
If you are going to attempt to run something like init, you currently need to run privledged or start to use systemd-container when it becomes availabel.

I wrote about this in 

http://developerblog.redhat.com/2014/05/05/running-systemd-within-docker-container/

There have been some advances since then but this is close to what you have to do.

Comment 2 Yajo 2014-07-29 08:04:50 UTC
Oh I read after submitting the bug, sorry about the noise.

> http://developerblog.redhat.com/2014/05/05/running-systemd-within-docker-container/
>
> There have been some advances since then but this is close to what you have to do.

Is there any image of that at Docker Hub? Also, is there any bug where to follow the progress of this?

Thanks!

Comment 3 Daniel Walsh 2014-07-30 09:00:04 UTC
Not currently but most likely I will publish an update to that blog when systemd-container is released into Fedora and RHEL7.


Note You need to log in before you can comment on or make changes to this bug.