Bug 1460779 - adding /dev/net/tun to a container with --cap-add=NET_ADMIN fails
adding /dev/net/tun to a container with --cap-add=NET_ADMIN fails
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: container-selinux (Show other bugs)
25
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Lokesh Mandvekar
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-12 13:15 EDT by Brian (bex) Exelbierd
Modified: 2017-06-22 21:56 EDT (History)
6 users (show)

See Also:
Fixed In Version: container-selinux-2.19-1.fc26 container-selinux-2.19-1.fc25
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-06-22 09:35:22 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Brian (bex) Exelbierd 2017-06-12 13:15:28 EDT
Description of problem:

Adding /dev/net/tun to a container and giving the privilege NET_ADMIN should allow the device to be used.  It doesn't.

Version-Release number of selected component (if applicable):

Fedora 25 Container

How reproducible:

always

Steps to Reproduce and failed results:
1. docker run z --device /dev/net/tun -p 1194:1194/udp --cap-add=NET_ADMIN -it -v ... bex-openvpn bash
2. (in the container) # openvpn config file
...
Mon Jun 12 17:08:57 2017 ERROR: Cannot ioctl TUNSETIFF tun: Permission denied (errno=13)
Mon Jun 12 17:08:57 2017 Exiting due to fatal error

3. in the base system's journal
setroubleshoot[1009]: SELinux is preventing openvpn from create access on the tun_socket Unknown. For complete SELinux messages. run sealert -l b8b2caa6-3f51-4f03-8b18-748f3b073ba3
python3[1009]: SELinux is preventing openvpn from create access on the tun_socket Unknown.
                                                          
                                                          *****  Plugin catchall (100. confidence) suggests   **************************
                                                          
                                                          If you believe that openvpn should be allowed create access on the Unknown tun_socket by default.
                                                          Then you should report this as a bug.
                                                          You can generate a local policy module to allow this access.
                                                          Do
                                                          allow this access for now by executing:
                                                          # ausearch -c 'openvpn' --raw | audit2allow -M my-openvpn
                                                          # semodule -X 300 -i my-openvpn.pp

# sealert -l b8b2caa6-3f51-4f03-8b18-748f3b073ba3
SELinux is preventing openvpn from create access on the tun_socket Unknown.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that openvpn should be allowed create access on the Unknown tun_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'openvpn' --raw | audit2allow -M my-openvpn
# semodule -X 300 -i my-openvpn.pp


Additional Information:
Source Context                system_u:system_r:container_t:s0:c77,c594
Target Context                system_u:system_r:container_t:s0:c77,c594
Target Objects                Unknown [ tun_socket ]
Source                        openvpn
Source Path                   openvpn
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-225.11.fc25.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     dhcp129-113.brq.redhat.com
Platform                      Linux dhcp129-113.brq.redhat.com
                              4.10.10-200.fc25.x86_64 #1 SMP Thu Apr 13 01:11:51
                              UTC 2017 x86_64 x86_64
Alert Count                   1
First Seen                    2017-06-12 18:03:24 CEST
Last Seen                     2017-06-12 18:03:24 CEST
Local ID                      b8b2caa6-3f51-4f03-8b18-748f3b073ba3

Raw Audit Messages
type=AVC msg=audit(1497283404.276:5236): avc:  denied  { create } for  pid=928 comm="openvpn" scontext=system_u:system_r:container_t:s0:c77,c594 tcontext=system_u:system_r:container_t:s0:c77,c594 tclass=tun_socket permissive=0


Hash: openvpn,container_t,container_t,tun_socket,create



Expected results:

openvpn starts
Comment 1 Daniel Walsh 2017-06-12 14:16:03 EDT
Fixed in container-selinux-2.19
Comment 2 Brian (bex) Exelbierd 2017-06-12 14:46:47 EDT
Could this get built for F25 as we don't seem to have later fedora images in docker hub?  This would allow me to test it.
Comment 3 Daniel Walsh 2017-06-12 15:45:21 EDT
Building it now.
Comment 5 Brian (bex) Exelbierd 2017-06-13 03:11:28 EDT
I have not been able to verify this works.  I tested it by building a container that specifically dnf installed the rpm from the koji build above.

Using just --cap-add=NET_ADMIN still gets me the same error.

Is this the wrong way to test this?
Comment 6 Daniel Walsh 2017-06-13 10:30:56 EDT
The RPM needs to be installed on the host, not in the container.
Comment 7 Brian (bex) Exelbierd 2017-06-13 10:34:08 EDT
(In reply to Daniel Walsh from comment #6)
> The RPM needs to be installed on the host, not in the container.

HAHAHA.

Well know that that is sorted out it works for me.  Let me know if it hits bodhi so I can add some karma.
Comment 8 Daniel Walsh 2017-06-13 17:17:49 EDT
I have released a new version for Fedora 26, but want to wait til tomorrow for F25, since there is a previous version of container-selinux out that needs one more karma or day so that I can push it.
Comment 9 Fedora Update System 2017-06-14 07:48:14 EDT
container-selinux-2.19-1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-ddc47a53ee
Comment 10 Fedora Update System 2017-06-14 07:48:21 EDT
container-selinux-2.19-1.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-607d2c542d
Comment 11 Daniel Walsh 2017-06-14 09:30:32 EDT
Brian, you can test and update karma now.
Comment 12 Brian (bex) Exelbierd 2017-06-14 10:11:32 EDT
(In reply to Daniel Walsh from comment #11)
> Brian, you can test and update karma now.

karma'ed

Thank you again for the speedy fix on this!
Comment 13 Fedora Update System 2017-06-15 06:58:19 EDT
container-selinux-2.19-1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-ddc47a53ee
Comment 14 Fedora Update System 2017-06-15 09:59:57 EDT
container-selinux-2.19-1.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-607d2c542d
Comment 15 Fedora Update System 2017-06-22 09:35:22 EDT
container-selinux-2.19-1.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.
Comment 16 Fedora Update System 2017-06-22 21:56:41 EDT
container-selinux-2.19-1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.