Hide Forgot
Description of problem: I'm seeing the following AVC's while trying to create a router: Version-Release number of selected component (if applicable): docker-selinux-1.10.3-46.el7.14.x86_64 docker-1.10.3-46.el7.14.x86_64 selinux-policy-3.13.1-102.el7.noarch atomic-openshift-3.4.0.15-1.git.0.9c963ec.el7.x86_64 # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.3 (Maipo) # uname -r 3.10.0-514.el7.x86_64 How reproducible: 100% Steps to Reproduce: 1. # oadm router storage-project-router --replicas=1 2. 3. Actual results: Router creation is NOT successful and AVC's are seen Expected results: Router creation should be successful and NO AVC's should be seen Additional info: ############ type=AVC msg=audit(1477421059.638:30124): avc: denied { transition } for pid=3075 comm="exe" path="/usr/bin/pod" dev="dm-8" ino=27266165 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c2,c3 tclass=process type=AVC msg=audit(1477421062.021:30126): avc: denied { transition } for pid=3095 comm="exe" path="/usr/bin/pod" dev="dm-9" ino=27266165 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c4,c9 tclass=process type=AVC msg=audit(1477421069.356:30130): avc: denied { transition } for pid=3169 comm="exe" path="/usr/bin/pod" dev="dm-8" ino=27266165 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c2,c3 tclass=process ---- type=SYSCALL msg=audit(Wednesday 26 October 2016 A.863:30816) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0xc8205af290 a1=0xc8205af2a0 a2=0xc8200878c0 a3=0x0 items=0 ppid=3803 pid=11016 auid=unset uid=unknown(1001) gid=root euid=unknown(1001) suid=unknown(1001) fsuid=unknown(1001) egid=root sgid=root fsgid=root tty=(none) ses=unset comm=exe exe=/usr/bin/docker-current subj=system_u:system_r:unconfined_service_t:s0 key=(null) type=AVC msg=audit(Wednesday 26 October 2016 A.863:30816) : avc: denied { transition } for pid=11016 comm=exe path=/usr/bin/pod dev="dm-6" ino=27266165 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c4,c9 tclass=process allow svirt_lxc_net_t unconfined_service_t:process sigchld; allow unconfined_service_t svirt_lxc_net_t:process transition; #################
This is an openshift bug. Please assign it to that group for assistance.
Dan, can you take a look at this please? I am stumped.
Looks like docker is running with the wrong label. ps -eZ | grep docker ls -lZ /usr/bin/docker*
Dan, what would cause that? This is clearly not a networking bug. Is it misconfiguration or should I send this somewhere else?
Did you run the commands I suggested. Also dnf reinstall docker-selinux There was a mismatch between the version of docker-selinux and selinux-policy-package which was causing docker-selinux to fail to install, thus leaving the docker daemon running with the wrong type.
Thanks Dan. Prasanth, can you please do as Dan suggested?
(In reply to Daniel Walsh from comment #5) > Looks like docker is running with the wrong label. > > ps -eZ | grep docker > ls -lZ /usr/bin/docker* # ps -eZ | grep docker system_u:system_r:unconfined_service_t:s0 1251 ? 00:00:27 docker-current # ls -lZ /usr/bin/docker* -rwxr-xr-x. root root system_u:object_r:docker_exec_t:s0 /usr/bin/docker -rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/bin/docker-current -rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/bin/docker-storage-setup
(In reply to Daniel Walsh from comment #7) > Did you run the commands I suggested. > > Also > > dnf reinstall docker-selinux > > There was a mismatch between the version of docker-selinux and > selinux-policy-package which was causing docker-selinux to fail to install, > thus leaving the docker daemon running with the wrong type. ############ Resolving Dependencies --> Running transaction check ---> Package docker-selinux.x86_64 0:1.10.3-46.el7.14 will be reinstalled --> Finished Dependency Resolution Dependencies Resolved ========================================================================== Package Arch Version Repository Size ========================================================================== Reinstalling: docker-selinux x86_64 1.10.3-46.el7.14 rhel-7-server-extras-rpms 79 k Transaction Summary ========================================================================== Reinstall 1 Package Total download size: 79 k Installed size: 27 k Is this ok [y/d/N]: y Downloading packages: docker-selinux-1.10.3-46.el7.14.x86_64.rpm | 79 kB 00:01 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : docker-selinux-1.10.3-46.el7.14.x86_64 1/1 Re-declaration of boolean virt_sandbox_use_fusefs Failed to create node Bad boolean declaration at /etc/selinux/targeted/tmp/modules/100/virt/cil:159 /usr/sbin/semodule: Failed! libsemanage.semanage_direct_install_info: Overriding docker module at lower priority 100 with module at priority 400. Verifying : docker-selinux-1.10.3-46.el7.14.x86_64 1/1 Installed: docker-selinux.x86_64 0:1.10.3-46.el7.14 Complete! #############
I think you are supposed to be using docker-1.10.3-57.el7
(In reply to Daniel Walsh from comment #11) > I think you are supposed to be using docker-1.10.3-57.el7 The above build was not yet available in the puddles and hence it failed to update to the latest. However, I tried manually upgrading to this build as suggested and following are the results: ######## # ps -eZ | grep docker system_u:system_r:docker_t:s0 1305 ? 00:06:10 docker-current # ls -lZ /usr/bin/docker* -rwxr-xr-x. root root system_u:object_r:docker_exec_t:s0 /usr/bin/docker -rwxr-xr-x. root root system_u:object_r:docker_exec_t:s0 /usr/bin/docker-current -rwxr-xr-x. root root system_u:object_r:docker_exec_t:s0 /usr/bin/docker-storage-setup -rwx------. root root system_u:object_r:docker_exec_t:s0 /usr/bin/docker-v1.10-migrator-helper -rwx------. root root system_u:object_r:docker_exec_t:s0 /usr/bin/docker-v1.10-migrator-local ######## I'll now try creating a router and then see how it goes.
I've re-tested this using the latest RHEL-7.3 GA bits and looks like the router creation works well with SELinux in Enforcing mode. ####### selinux-policy-3.13.1-102.el7_3.4.noarch docker-selinux-1.10.3-57.el7.x86_64 NAME REVISION DESIRED CURRENT TRIGGERED BY dc/storage-project-router 1 1 1 config NAME DESIRED CURRENT READY AGE rc/storage-project-router-1 1 1 1 4m NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE svc/storage-project-router 172.30.131.240 <none> 80/TCP,443/TCP,1936/TCP 4m NAME READY STATUS RESTARTS AGE po/storage-project-router-1-uuomp 1/1 Running 0 4m # oc get pods NAME READY STATUS RESTARTS AGE storage-project-router-1-uuomp 1/1 Running 0 1m #######