RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1187236 - warning: Failed to open SELinux handle error seen during yum install when -v /:/host is set
Summary: warning: Failed to open SELinux handle error seen during yum install when -v ...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: rhel-server-container
Version: 7.2
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Lokesh Mandvekar
QA Contact: atomic-bugs@redhat.com
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-29 15:33 UTC by Jeremy Eder
Modified: 2020-12-10 11:55 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-12-10 11:55:32 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2620 0 normal SHIPPED_LIVE Red Hat Enterprise Linux 7.3 Container Image Update 2016-11-03 20:01:11 UTC

Description Jeremy Eder 2015-01-29 15:33:12 UTC 
Using -v /:/host
-bash-4.2# docker run -t -i -v /:/host -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-tools-docker-7.1-1-spc rhel-tools-docker-7.1-1 yum localinstall http://download.devel.redhat.com/rel-eng/RHEL-7.1-20150129.0/compose/Server/x86_64/os/Packages/ElectricFence-2.2.2-39.el7.x86_64.rpm -y -q
warning: Failed to open SELinux handle.
-bash-4.2#

After removing -v /:/host no more "warning: Failed to open SELinux handle." warning:
-bash-4.2# docker run -t -i --privileged -v /run:/run --net=host --ipc=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-tools-docker-7.1-1-spc rhel-tools-docker-7.1-1 yum localinstall http://download.devel.redhat.com/rel-eng/RHEL-7.1-20150129.0/compose/Server/x86_64/os/Packages/ElectricFence-2.2.2-39.el7.x86_64.rpm -y -q
-bash-4.2#
Comment 1 Jeremy Eder 2015-01-29 15:55:24 UTC 
open("/etc/selinux/config", O_RDONLY)   = -1 ENOENT (No such file or directory)
futex(0x7f83e0699728, FUTEX_WAKE_PRIVATE, 2147483647) = 0
open("/host/sys/fs/selinux/status", O_RDONLY|O_CLOEXEC) = 31
mmap(NULL, 4096, PROT_READ, MAP_SHARED, 31, 0) = 0x7f83e1c9c000
open("/etc/selinux/targeted/contexts/files/file_contexts.subs_dist", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/selinux/targeted/contexts/files/file_contexts.subs", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/selinux/targeted/contexts/files/file_contexts", O_RDONLY) = -1 ENOENT (No such file or directory)
fstat(19, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f83e1c9b000
write(19, "warning: Failed to open SELinux "..., 40) = 40
Comment 3 Daniel Walsh 2015-01-29 16:19:19 UTC 
Does the container think SELinux is enabled?

id -Z

How does yum even know about the $HOST?
Comment 4 Jeremy Eder 2015-01-29 16:24:32 UTC 
Using -v /:/host
-bash-4.2# docker run -t -i --rm -v /:/host -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-t-docker-7.1-1-spc rhel-tools-docker-7.1-1 id -Z
system_u:system_r:docker_t:s0

After removing -v /:/host
-bash-4.2# docker run -t -i --rm -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-tools-docker-7.1-1-spc rhel-tools-docker-7.1-1 id -Z
id: --context (-Z) works only on an SELinux-enabled kernel
Comment 5 Daniel Walsh 2015-01-29 16:26:44 UTC 
setsebool -P docker_transition_unconfined 1

Which I think we need to turn on by default.

I have no idea why / mounted at /host would tell libselinux to activate.

The only way I would see thi would be if /sys:/sys was mounted.
Comment 6 Jeremy Eder 2015-01-29 16:32:19 UTC 
Dan it's your call, but perhaps we can table this for now, as yum works in the rhel-tools container despite the warning.  I set the prio to medium.

-bash-4.2# setsebool -P docker_transition_unconfined 1

-bash-4.2# getsebool docker_transition_unconfined
docker_transition_unconfined --> on

-bash-4.2# docker run -t -i --rm -v /:/host -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-tools-docker-7.1-1-spc rhel-tools-docker-7.1-1 id -Z
system_u:system_r:unconfined_t:s0

-bash-4.2# docker run -t -i --rm -v /run:/run --net=host --ipc=host --pid=host -e HOST=/host -e NAME=rhel-tools-docker-7.1-1-spc -e IMAGE=rhel-tools-docker-7.1-1 --name rhel-tools-docker-7.1-1-spc rhel-tools-docker-7.1-1 id -Z
id: --context (-Z) works only on an SELinux-enabled kernel
Comment 7 Václav Pavlín 2015-04-07 08:35:38 UTC 
What should actually be done to fix this in an image?
Comment 8 Daniel Walsh 2015-04-08 22:13:11 UTC 
We are working to fix this in policy.  Not an image.  We want all privileged containers to run as spc_t and then allow domains to communicate with them.  We used to run as unconfined_t but this is really a user context.  

spc_t will be an unconfined domain, which other domains can communicate with since we will probably have confined domains and containers that need to talk to a SPC container.
Comment 13 Daniel Walsh 2016-08-19 21:41:17 UTC 
We have changed atomic --spc to mount /sys/fs/selinux as readonly to tell SELinux not to do labels stuff.
Note You need to log in before you can comment on or make changes to this bug.