Bug 1395829 - SELinux is preventing openssl from 'write' accesses on the file uptime.
Summary: SELinux is preventing openssl from 'write' accesses on the file uptime.
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 25
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:aac247a4deff2bbd4e61444bc2d...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-16 19:15 UTC by Jakub Bittner
Modified: 2017-05-11 14:41 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-05-11 14:41:46 UTC
Type: ---


Attachments (Terms of Use)

Description Jakub Bittner 2016-11-16 19:15:27 UTC
Description of problem:
running docker-compose
SELinux is preventing openssl from 'write' accesses on the file uptime.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that openssl should be allowed write access on the uptime file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'openssl' --raw | audit2allow -M my-openssl
# semodule -X 300 -i my-openssl.pp

Additional Information:
Source Context                system_u:system_r:container_t:s0:c94,c744
Target Context                system_u:object_r:proc_t:s0
Target Objects                uptime [ file ]
Source                        openssl
Source Path                   openssl
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-222.fc25.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.8.6-300.fc25.x86_64+debug #1 SMP
                              Tue Nov 1 12:21:53 UTC 2016 x86_64 x86_64
Alert Count                   6
First Seen                    2016-11-16 20:13:06 CET
Last Seen                     2016-11-16 20:13:06 CET
Local ID                      384753e7-7c94-4c89-a5cf-ebc82796006f

Raw Audit Messages
type=AVC msg=audit(1479323586.498:622): avc:  denied  { write } for  pid=13587 comm="openssl" name="uptime" dev="proc" ino=4026532004 scontext=system_u:system_r:container_t:s0:c94,c744 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=0


Hash: openssl,container_t,proc_t,file,write

Version-Release number of selected component:
selinux-policy-3.13.1-222.fc25.noarch

Additional info:
reporter:       libreport-2.8.0
hashmarkername: setroubleshoot
kernel:         4.8.6-300.fc25.x86_64+debug
type:           libreport

Comment 1 Daniel Walsh 2016-11-16 23:28:26 UTC
Did the container work?  This looks like something we should block.  

I believe it would not be allowed without the SELinux issue.

In Container
# echo 0 >> /proc/uptime 
sh: /proc/uptime: Permission denied

Outside the container
#setenforce 0

Back inside the container
# echo 0 >> /proc/uptime 
sh: echo: write error: Input/output error

Comment 2 Matthias Runge 2017-05-10 17:55:17 UTC
in my case, there is no container running, or docker service started.

Comment 3 Daniel Walsh 2017-05-11 12:42:58 UTC
Some tools told the process to run as container_t?  systemd-nspawn? runc? systemd? docker? ...

Comment 4 Matthias Runge 2017-05-11 13:05:58 UTC
(In reply to Daniel Walsh from comment #3)
> Some tools told the process to run as container_t?  systemd-nspawn? runc?
> systemd? docker? ...

I have docker installed and was starting the service from time to time. But usually it is disabled. systemd is there, of course.

Comment 5 Lukas Vrabec 2017-05-11 14:41:46 UTC
We see AVC where is Source domain *container_t* these domains are for containers so I believe this is container related. 

I agree that this should *NOT* be allowed. 

Closing this BZ as WONTFIX. 

Jakub, 
If you have anything broken on your system feel free to re-open this issue. What kind of containers are you running on your system?


Note You need to log in before you can comment on or make changes to this bug.