Bug 1425574
| Summary: | version 2.9 blocking container commands | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jhon Honce <jhonce> |
| Component: | container-selinux | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Martin Jenner <mjenner> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.3 | CC: | bparees, lsm5, mifiedle, skuznets, vlaad |
| Target Milestone: | rc | Keywords: | TestBlocker |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | container-selinux-2:2.9-4 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-03-02 19:11:26 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I don't see SELinux blocking anything, although LD_LIB does not seem to be set in the environment. No idea if this is a new docker issue or an issue with the Container Image. Definitely not something SELinux is blocking. # docker run centos/ruby-22-centos7 env MANPATH=/opt/rh/v8314/root/usr/share/man:/opt/rh/nodejs010/root/usr/share/man:/opt/rh/rh-ruby22/root/usr/share/man: HOSTNAME=cc48db62156e LIBRARY_PATH=/opt/rh/v8314/root/usr/lib64 X_SCLS=v8314 nodejs010 rh-ruby22 CPATH=/opt/rh/v8314/root/usr/include PATH=/opt/rh/v8314/root/usr/bin:/opt/rh/nodejs010/root/usr/bin:/opt/rh/rh-ruby22/root/usr/bin:/opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin PWD=/opt/app-root/src STI_SCRIPTS_URL=image:///usr/libexec/s2i STI_SCRIPTS_PATH=/usr/libexec/s2i SHLVL=0 HOME=/opt/app-root/src PYTHONPATH=/opt/rh/v8314/root/usr/lib/python2.7/site-packages:/opt/rh/nodejs010/root/usr/lib/python2.7/site-packages XDG_DATA_DIRS=/opt/rh/rh-ruby22/root/usr/share PKG_CONFIG_PATH=/opt/rh/v8314/root/usr/lib64/pkgconfig:/opt/rh/rh-ruby22/root/usr/lib64/pkgconfig RUBY_VERSION=2.2 *** Bug 1425545 has been marked as a duplicate of this bug. *** The container image hasn't changed in the last 6 days, while this issue started happening yesterday when we updated our docker+container-selinux packages, so I would assume it is docker/selinux related. Furthermore I've got an environment w/ docker 1.12.6 and an older container-selinux where things work correctly (but it's a fedora env), so that would seem to point to a change in container-selinux. Note that the LD_LIBRARY_PATH gets set by an scl_enable script that's implicitly invoked, so perhaps something in there is silently failing w/ selinux on, which results in the LD_LIBRARY_PATH not getting set. But i'd still expect whatever is failing there to show up in the selinux audit logs. To be more clear, the error here is not in the invocation of `env` but in the process attributes in the container: # docker run -ti centos/ruby-22-centos7 cat /proc/self/attr/current system_u:system_r:spc_t:s0:c386,c759 Dan posted the following on IRC: dwalsh| docker run -ti centos/ruby-22-centos7 sh dwalsh| sh-4.2$ cat /proc/self/attr/current dwalsh| system_u:system_r:spc_t:s0:c4,c281sh-4.2$ dwalsh| But if I look at the specification handed to runc I see. dwalsh| cat state.json | json_pp | grep svirt dwalsh| "process_label" : "system_u:system_r:svirt_lxc_net_t:s0:c4,c281", dwalsh| "mount_label" : "system_u:object_r:svirt_sandbox_file_t:s0:c4,c281", dwalsh| Which to me indicates runc was not built with SELinux support? This code was causing the issue. gen_require(` type svirt_sandbox_file_t; ') domtrans_pattern(svirt_lxc_net_t,svirt_sandbox_file_t,spc_t) Ok this is an container-selinux issue. Fixed in container-selinux-2.9-4.el7.src.rpm Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHEA-2017-0416.html |
Description of problem: selinux is denying container access for commands that worked under version container-selinux 2.6 Version-Release number of selected component (if applicable): container-selinux-2.9-3.el7.noarch How reproducible: Always Steps to Reproduce: 1. setenforce 1 2. docker run centos/ruby-22-centos7 env | grep LD_LIB (no output) 3. setenforce 0 4. docker run centos/ruby-22-centos7 env | grep LD_LIB (value of LD_LIBRARY_PATH) 5. setenforce 1 Actual results: # docker run centos/ruby-22-centos7 env | grep LD_LIB # Expected results: # docker run centos/ruby-22-centos7 env | grep LD_LIB LD_LIBRARY_PATH=/opt/rh/v8314/root/usr/lib64:/opt/rh/nodejs010/root/usr/lib64:/opt/rh/rh-ruby22/root/usr/lib64 Additional info: [root@rhel73 audit]# audit2allow -a #============= svirt_lxc_net_t ============== #!!!! This avc has a dontaudit rule in the current policy allow svirt_lxc_net_t spc_t:process { noatsecure rlimitinh siginh };