Bug 1256882 - SELinux preventing execution of bind-mounted binaries under home folder
SELinux preventing execution of bind-mounted binaries under home folder
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: docker (Show other bugs)
22
Unspecified Linux
high Severity high
: ---
: ---
Assigned To: Lokesh Mandvekar
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-08-25 12:13 EDT by Roland Grunberg
Modified: 2015-09-28 14:47 EDT (History)
11 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-09-28 14:47:11 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Roland Grunberg 2015-08-25 12:13:33 EDT
SELinux prevents the execution of a binary under /home that is bind mounted within a container.

Steps to reproduce :

$ pwd
/home/rgrunberg/workspace/hello

$ ls -lZ hello
-rwxrwxr-x. 1 rgrunberg rgrunberg unconfined_u:object_r:user_home_t:s0 8504 Aug 25 11:16 hello

$ docker run -v $(pwd):/tmp/hello fedora:22 /tmp/hello/hello
/tmp/hello/hello: error while loading shared libraries: cannot apply additional memory protection after relocation: Permission denied

Moving the file into /tmp on the host or just changing the file context to something like docker_exec_t seems to fix things so I'm wondering if it's possible to permit execution of user_home_t files within a container.

SELinux is preventing hello from read access on the file /tmp/hello/hello.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that hello should be allowed read access on the hello file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep hello /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:svirt_lxc_net_t:s0:c463,c931
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                /tmp/hello/hello [ file ]
Source                        hello
Source Path                   hello
Port                          <Unknown>
Host                          tornero
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.10.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     tornero
Platform                      Linux tornero 4.1.5-200.fc22.x86_64 #1 SMP Mon Aug
                              10 23:38:23 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-08-25 11:08:16 EDT
Last Seen                     2015-08-25 11:08:16 EDT
Local ID                      b72fe89e-238d-457d-abd7-0558c07d8ec5

Raw Audit Messages
type=AVC msg=audit(1440515296.252:858): avc:  denied  { read } for  pid=2385 comm="hello" path="/tmp/hello/hello" dev="sda3" ino=685602 scontext=system_u:system_r:svirt_lxc_net_t:s0:c463,c931 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0


Hash: hello,svirt_lxc_net_t,user_home_t,file,read
Comment 1 Daniel Walsh 2015-09-28 14:47:11 EDT
Using docker run -v /tmp/hello/hello:/hello:Z 

Should fix this.

Note You need to log in before you can comment on or make changes to this bug.