Bug 1230098 - SELinux is preventing /usr/bin/bash from 'write' accesses on the directory addons.
Summary: SELinux is preventing /usr/bin/bash from 'write' accesses on the directory ad...
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: docker   
(Show other bugs)
Version: 22
Hardware: x86_64 Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lokesh Mandvekar
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:e5e232f7d392d635a7b7273a5aa...
Keywords:
: 1230106 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-06-10 08:59 UTC by Yajo
Modified: 2015-07-15 20:39 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-07-15 20:39:04 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Yajo 2015-06-10 08:59:33 UTC
Description of problem:
Starting a docker container.
SELinux is preventing /usr/bin/bash from 'write' accesses on the directory addons.

*****  Plugin catchall (100. confidence) suggests   **************************

If cree que de manera predeterminada, bash debería permitir acceso write sobre  addons directory.     
Then debería reportar esto como un error.
Puede generar un módulo de política local para permitir este acceso.
Do
permita el acceso momentáneamente executando:
# grep launch /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:svirt_lxc_net_t:s0:c147,c266
Target Context                system_u:object_r:svirt_sandbox_file_t:s0:c372,c41
                              0
Target Objects                addons [ dir ]
Source                        launch
Source Path                   /usr/bin/bash
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           bash-4.3.39-1.fc22.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-126.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.0.4-303.fc22.x86_64 #1 SMP Thu
                              May 28 12:37:06 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-06-10 10:57:05 CEST
Last Seen                     2015-06-10 10:57:05 CEST
Local ID                      bc05ca1f-ebd1-4e19-98ba-be60d5fc1ab6

Raw Audit Messages
type=AVC msg=audit(1433926625.524:1347): avc:  denied  { write } for  pid=29280 comm="launch" name="addons" dev="dm-2" ino=2491404 scontext=system_u:system_r:svirt_lxc_net_t:s0:c147,c266 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c372,c410 tclass=dir permissive=0


type=SYSCALL msg=audit(1433926625.524:1347): arch=x86_64 syscall=faccessat success=no exit=EACCES a0=ffffffffffffff9c a1=15e7ee0 a2=2 a3=7fffb77f8df0 items=0 ppid=27290 pid=29280 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=launch exe=/usr/bin/bash subj=system_u:system_r:svirt_lxc_net_t:s0:c147,c266 key=(null)

Hash: launch,svirt_lxc_net_t,svirt_sandbox_file_t,dir,write

Version-Release number of selected component:
selinux-policy-3.13.1-126.fc22.noarch

Additional info:
reporter:       libreport-2.5.1
hashmarkername: setroubleshoot
kernel:         4.0.4-303.fc22.x86_64
type:           libreport

Comment 1 Daniel Walsh 2015-06-10 12:50:58 UTC
This looks like you have a file from one container being used by another, without relabeling?

Comment 2 Daniel Walsh 2015-06-10 12:52:37 UTC
*** Bug 1230106 has been marked as a duplicate of this bug. ***

Comment 3 Yajo 2015-06-11 09:11:36 UTC
It's actually a directory from the host mounted in the container.

It's strange that SELinux prevents writing, because it's mounted as read only. And BTW I was not able to read it from the container until I disabled selinux.

Before starting the container I have a script like this:

# Prepare addons
chcon -Rt svirt_sandbox_file_t ./app/addons
chmod -R u=rwX,g=rX,o= ./app/addons

# Start
./docker-compose up $@

It's the label that I was using until F21. I don't know if it has changed.

Comment 4 Daniel Walsh 2015-06-11 12:31:26 UTC
You need to mount it using Z or z, since at some point it got a different containers labels on it.

You container processes are running with this label,
system_u:system_r:svirt_lxc_net_t:s0:c147,c266 

Notice the s0:c147,c266

The volume mount is labeled

system_u:object_r:svirt_sandbox_file_t:s0:c372,c410

Notice the MCS label s0:c372,c410

MCS Security prevents read/write of content with different MCS labels.  However it will allow read/write of content labeled with an s0 label.

If you volume mount a image with -v /SOURCE:/DESTINATION:z docker will automatically relabel the content for you to s0.  If you volume mount with a "Z", then the label will be specific to the container, and not be able to be shared between containers.

Comment 5 Yajo 2015-06-12 08:31:04 UTC
(In reply to Daniel Walsh from comment #4)
> If you volume mount a image with -v /SOURCE:/DESTINATION:z docker will
> automatically relabel the content for you to s0.  If you volume mount with a
> "Z", then the label will be specific to the container, and not be able to be
> shared between containers.

It does not seem to work:

$ mkdir dir                                                 
$ touch dir/touched                                         
$ sudo setenforce 0
$ sudo docker run -it --rm -v (pwd)/dir/:/opt:roz centos ls /opt/
touched  # https://bugzilla.redhat.com/show_bug.cgi?id=1230105#c13

$ sudo restorecon -v /usr/bin/docker 
$ docker run -it --rm -v (pwd)/dir/:/opt:roz centos ls /opt/
touched  # https://bugzilla.redhat.com/show_bug.cgi?id=1230105#c14

$ sudo setenforce 1
$ docker run -it --rm -v (pwd)/dir/:/opt:roz centos ls /opt/
permission denied
FATA[0002] Error response from daemon: Cannot start container 95fc82a1b3dcf7324327c8a23f03de7400c0b8a6533bc6ea623424b92454b2e4: [8] System error: permission denied

Comment 6 Yajo 2015-06-15 08:21:23 UTC
Description of problem:
docker-compose up

I have docker-1.7.0-4.git5b82e1d.fc22.x86_64 from updates-testing.

Version-Release number of selected component:
selinux-policy-3.13.1-128.1.fc22.noarch

Additional info:
reporter:       libreport-2.5.1
hashmarkername: setroubleshoot
kernel:         4.0.4-303.fc22.x86_64
type:           libreport

Comment 7 Yajo 2015-06-15 08:38:04 UTC
Description of problem:
Run su in a docker container using docker-1.7.0-4.git5b82e1d.fc22.x86_64 from updates-testing.

Version-Release number of selected component:
selinux-policy-3.13.1-128.1.fc22.noarch

Additional info:
reporter:       libreport-2.5.1
hashmarkername: setroubleshoot
kernel:         4.0.4-303.fc22.x86_64
type:           libreport

Comment 8 Daniel Walsh 2015-06-15 12:28:41 UTC
Should be

$ docker run -it --rm -v (pwd)/dir/:/opt:ro,z centos ls /opt/

If this blows up on you what does

# ausearch -m avc -ts recent 

Show?

Comment 9 Yajo 2015-06-16 07:21:25 UTC
That worked indeed. I could not find any docs regarding the comma. But have in mind that I'm using now docker-1.7.0-4.git5b82e1d.fc22.x86_64.

Comment 10 Yajo 2015-06-16 07:21:42 UTC
BTW, it worked fine with setenforce 1.

Comment 11 Daniel Walsh 2015-07-15 20:39:04 UTC
man docker run
...
       Note: Multiple Volume options can be added separated by a ","


Note You need to log in before you can comment on or make changes to this bug.