Several SELinux issues come up when playing with prctl(NO_NEW_PRIVS) applications. NO_NEW_PRIVS prevents SELinux transitions from one domain to another iff the second domain has more privs then the first. This is difficult to test. It would be nice to be able to use runcon to diagnose issues. I would like to see a flag like runcon --no-new-privs -t svirt_lxc_net_t /bin/sh And have it tell me whether or not the transition is happening.
Sounds reasonable. I will propose a patch upstream. For the reference, here is some documentation of the no_new_privs bit: https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt
Please see http://lists.gnu.org/archive/html/coreutils/2017-04/msg00046.html This idea is being discussed there.
Solution for this problem was added in this upstream commit: http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=commitdiff;h=v8.27-37-g6ebaf81#patch1
coreutils-8.27-6.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-a3eac38fa8
coreutils-8.27-6.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-a3eac38fa8
coreutils-8.27-6.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.