docker-1.7.0-15.gitdcff4e1.fc23.x86_64 docker run -ti --rm fedora:latest /bin/bash dnf install -y procps-ng ps -efZ # ps -efZ LABEL UID PID PPID C STIME TTY TIME CMD system_u:system_r:docker_t:s0 root 1 0 0 17:49 ? 00:00:00 /bin/bash system_u:system_r:docker_t:s0 root 31 1 0 17:50 ? 00:00:00 ps -efZ Seems to me this should be spc_t, not docker_t
Dan, is this a docker-selinux issue?
Yes. I have the lates docker.pp installed and I see the following # docker run --privileged --rm -ti fedora /bin/sh # cat /proc/self/attr/current system_u:system_r:spc_t:s0sh-4.3# So I don't think you have the latest docker-selinux package updated.
docker-selinux-1.7.0-15.gitdcff4e1.fc23.x86_64
Yes I am not sure Lokesh has been grabbing latest code out of git:fedora-cloud/docker-selinux.git grep spc_t docker.te type spc_t; domain_type(spc_t) role system_r types spc_t; kernel_unlabeled_entry_type(spc_t) kernel_unlabeled_domtrans(docker_t, spc_t) domain_entry_file(spc_t, docker_share_t) domain_entry_file(spc_t, docker_var_lib_t) role system_r types spc_t; domain_entry_file(spc_t, docker_share_t) domain_entry_file(spc_t, docker_var_lib_t) domtrans_pattern(docker_t, docker_share_t, spc_t) domtrans_pattern(docker_t, docker_var_lib_t, spc_t) allow docker_t spc_t:process { setsched signal_perms }; ps_process_pattern(docker_t, spc_t) allow docker_t spc_t:socket_class_set { relabelto relabelfrom }; dbus_chat_system_bus(spc_t) unconfined_domain_noaudit(spc_t) virt_transition_svirt_sandbox(spc_t, system_r)
whoops, gotta modify my daily rebuild script to pull in from docker-selinux master. This will be fixed in 1.7.0-16
-16 seems better to me!
Make sure we get this out to F21, F22 and RHEL7 packages.
This bug appears to have been reported against 'rawhide' during the Fedora 23 development cycle. Changing version to '23'. (As we did not run this process for some time, it could affect also pre-Fedora 23 development cycle bugs. We are very sorry. It will help us with cleanup during Fedora 23 End Of Life. Thank you.) More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora23