Bug 1445226
| Summary: | selinux policy does not allow execute on fusefs filesystems (like glusterfs) | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Humble Chirammal <hchiramm> |
| Component: | container-selinux | Assignee: | Lokesh Mandvekar <lsm5> |
| Status: | CLOSED ERRATA | QA Contact: | Martin Jenner <mjenner> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 7.3 | CC: | aos-bugs, bchilds, dwalsh, eparis, fkrska, hchiramm, jamills, jhou, jligon, jokerman, jrosenta, lfriedma, lvrabec, madam, mgrepl, misalunk, mmalik, mmccomas, mrobson, plautrba, pprakash, pvrabec, qcai, rcyriac, ssekidde, vwalek, wmeng |
| Target Milestone: | rc | Keywords: | Extras |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | container-selinux-2.12-1.gite7096ce.el7_3 | Doc Type: | Bug Fix |
| Doc Text: |
The SELinux boolean to allow containers to use fuse file systems, did not allow them to execute content on a fuse file system. This update will add the allow rules for executing content.
|
Story Points: | --- |
| Clone Of: | 1441216 | Environment: | |
| Last Closed: | 2017-05-26 14:55:47 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1441216 | ||
|
Comment 6
Eric Paris
2017-05-01 14:59:48 UTC
We are moving control of the container domains to container-selinux so we have more flexibility. This change is fine with me. We can discuss the ability to mount/umount in a separate discussion.
So we installed selinux modules on your Openshift node which helped.
Summary ->
we oc rsh'ed in to jenkins pod
executed the script which gave permission denied
We checked the audit logs
cat /var/log/audit.log | grep denied
We saw the following
avc: denied { execute }
# getsebool virt_sandbox_use_fusefs virt_use_fusefs
# grep fusefs /var/log/audit/audit.log | grep execute | audit2allow -M fusefstoexecutetemp
Installing the module on OpenShift node->
# semodule -i fusefstoexecutetemp.pp
Then again we oc rsh'ed to the jenkins pod and executed the script.
We saw the audit logs again and we saw ->
avc: denied { execute_no_trans }
- Checking and deleting earlier fusefstoexecutetemp
# semodule -l | grep fusefstoexecutetemp
# semodule -d fusefstoexecutetemp
Copy and add the contents to the new file as per the latest avc denial
# cp fusefstoexecutetemp.te fusefstoexecute.te
# Add the following to fusefstoexecute.te
##########################################################################
module fusefstoexecute 1.0;
require {
type svirt_lxc_net_t;
type fusefs_t;
class file { execute execute_no_trans };
}
#============= svirt_lxc_net_t ==============
allow svirt_lxc_net_t fusefs_t:file execute_no_trans;
allow svirt_lxc_net_t fusefs_t:file execute;
###########################################################################
Save the file and run the following.
# checkmodule -M -m -o fusefstoexecute.mod fusefstoexecute.te
# semodule_package -m fusefstoexecute.mod -o fusefstoexecute.pp
Install the module the same way as before.
# semodule -i fusefstoexecute.pp
Again we oc rsh'ed into the pod and then we were able to execute the script.
After the package will be released, told them that they can simply remove the workaround by running (on every node)
# semodule -l | grep fuse
fusefstoexecutetemp 1.0
fusefstoexecute 1.0
# semodule -d fusefstoexecutetemp
# semodule -d fusefstoexecute
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1331 |