Bug 1420096 - container-selinux SELinux rules broken
Summary: container-selinux SELinux rules broken
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: container-selinux
Version: rawhide
Hardware: armv7hl
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Lokesh Mandvekar
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1420822 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-07 19:34 UTC by Tomasz Kłoczko
Modified: 2017-02-09 17:44 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-02-09 17:44:09 UTC
Type: Bug


Attachments (Terms of Use)

Description Tomasz Kłoczko 2017-02-07 19:34:21 UTC
During upgrade on ARM:

  Upgrading   : container-selinux-2:2.6-1.fc26.noarch                                                                                                              14/45 
Child type container_t exceeds bounds of parent container_runtime_t
  (allow container_t container_t (capability2 (mac_override mac_admin)))
    <root>
    booleanif at /var/lib/selinux/targeted/tmp/modules/100/virt/cil:2721
    true at /var/lib/selinux/targeted/tmp/modules/100/virt/cil:2722
    allow at /var/lib/selinux/targeted/tmp/modules/100/virt/cil:2723
      (allow container_t self (capability2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read epolwakeup)))
  (allow container_t container_t (capability (sys_module)))
    <root>
    booleanif at /var/lib/selinux/targeted/tmp/modules/100/virt/cil:2721
    true at /var/lib/selinux/targeted/tmp/modules/100/virt/cil:2722
    allow at /var/lib/selinux/targeted/tmp/modules/100/virt/cil:2724
      (allow container_t self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
Failed to generate binary
/usr/sbin/semodule:  Failed!

Comment 1 Daniel Walsh 2017-02-07 20:51:24 UTC
This has to be fixed here

https://github.com/fedora-selinux/selinux-policy/pull/187

Comment 2 Daniel Walsh 2017-02-07 20:52:49 UTC
If you change the expand-check field in /etc/sysconfig/semange.conf to zero, the container-selinux should install fine.

expand-check = 0

Comment 3 Yanko Kaneti 2017-02-09 15:36:34 UTC
*** Bug 1420822 has been marked as a duplicate of this bug. ***

Comment 4 Daniel Walsh 2017-02-09 17:43:48 UTC
Fixed in selinux-policy-3.13.1-237.fc26.noarch


Note You need to log in before you can comment on or make changes to this bug.