Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionJan Pazdziora (Red Hat)
2017-10-27 09:46:35 UTC
Description of problem:
I typically start systemd in container with
docker run --name systemd -e container=docker --rm -ti fedora:26 /usr/sbin/init
When that -e container=docker is removed, there is an AVC denial logged
and error about /sys/fs/selinux shown.
Version-Release number of selected component (if applicable):
docker-1.12.6-61.git85d7426.el7.x86_64
oci-systemd-hook-0.1.14-1.git1ba44c6.el7.x86_64
selinux-policy-3.13.1-174.el7.noarch
container-selinux-2.28-1.git85ce147.el7.noarch
How reproducible:
Deterministic.
Steps to Reproduce:
1. docker run --name systemd --rm -ti fedora:26 /usr/sbin/init
Actual results:
# docker run --name systemd --rm -ti fedora:26 /usr/sbin/init
Mount failed for selinuxfs on /sys/fs/selinux: No such file or directory
Failed to set up the root directory for shared mount propagation: Operation not permitted
systemd 233 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN default-hierarchy=hybrid)
Detected virtualization kvm.
Detected architecture x86-64.
Welcome to Fedora 26 (Twenty Six)!
Set hostname to <1129ae388b7f>.
system.slice: Failed to set invocation ID on control group /system.slice/docker-1129ae388b7f4b670f9974b358f6175518afb6913f30733221ce9939e6b9812e.scope/system.slice, ignoring: Operation not permitted
[ OK ] Created slice System Slice.
[ OK ] Started Dispatch Password Requests to Console Directory Watch.
[ OK ] Listening on Process Core Dump Socket.
[ OK ] Reached target Remote File Systems.
[ OK ] Started Forward Password Requests to Wall Directory Watch.
[ OK ] Listening on Journal Socket (/dev/log).
[ OK ] Reached target Local File Systems.
[ OK ] Reached target Slices.
[...]
and in the audit.log, there is
type=AVC msg=audit(1509097145.769:69530): avc: denied { mounton } for pid=49342 comm="systemd" path="/proc" dev="proc" ino=1 scontext=system_u:system_r:svirt_lxc_net_t:s0:c320,c708 tcontext=system_u:object_r:proc_t:s0 tclass=dir
Expected results:
The same as with -e container=docker, no AVC denial and no
Mount failed for selinuxfs on /sys/fs/selinux: No such file or directory
Failed to set up the root directory for shared mount propagation: Operation not permitted
lines.
Additional info:
I was not able to see the same error (and AVC denial) with rhel7:7.4 image -- so
# docker run --name systemd --rm -ti registry.access.redhat.com/rhel7:7.4 /usr/sbin/init
works fine while running from fedora images (fedora:25, fedora:26, fedora:rawhide) fails.
THis is because the container image itself has the environment variable container=oci in the image.
We should build the Fedora/Centos/RHEL images with this environment variable set.
Franticek could you check to make sure the fedora/centos and rhel images are being build with
container=oci
In their images.
Comment 4Jan Pazdziora (Red Hat)
2017-12-07 14:08:31 UTC
We likely track adding the environment variable in bug 1399507. However, I'm not really sure what the proper component should be or who should make sure the change gets made.
We have no plans to ship another version of Docker at this time. RHEL7 is in final support stages where only security fixes will get released. Customers should move to use Podman which is available starting in RHEL 7.6.
Description of problem: I typically start systemd in container with docker run --name systemd -e container=docker --rm -ti fedora:26 /usr/sbin/init When that -e container=docker is removed, there is an AVC denial logged and error about /sys/fs/selinux shown. Version-Release number of selected component (if applicable): docker-1.12.6-61.git85d7426.el7.x86_64 oci-systemd-hook-0.1.14-1.git1ba44c6.el7.x86_64 selinux-policy-3.13.1-174.el7.noarch container-selinux-2.28-1.git85ce147.el7.noarch How reproducible: Deterministic. Steps to Reproduce: 1. docker run --name systemd --rm -ti fedora:26 /usr/sbin/init Actual results: # docker run --name systemd --rm -ti fedora:26 /usr/sbin/init Mount failed for selinuxfs on /sys/fs/selinux: No such file or directory Failed to set up the root directory for shared mount propagation: Operation not permitted systemd 233 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN default-hierarchy=hybrid) Detected virtualization kvm. Detected architecture x86-64. Welcome to Fedora 26 (Twenty Six)! Set hostname to <1129ae388b7f>. system.slice: Failed to set invocation ID on control group /system.slice/docker-1129ae388b7f4b670f9974b358f6175518afb6913f30733221ce9939e6b9812e.scope/system.slice, ignoring: Operation not permitted [ OK ] Created slice System Slice. [ OK ] Started Dispatch Password Requests to Console Directory Watch. [ OK ] Listening on Process Core Dump Socket. [ OK ] Reached target Remote File Systems. [ OK ] Started Forward Password Requests to Wall Directory Watch. [ OK ] Listening on Journal Socket (/dev/log). [ OK ] Reached target Local File Systems. [ OK ] Reached target Slices. [...] and in the audit.log, there is type=AVC msg=audit(1509097145.769:69530): avc: denied { mounton } for pid=49342 comm="systemd" path="/proc" dev="proc" ino=1 scontext=system_u:system_r:svirt_lxc_net_t:s0:c320,c708 tcontext=system_u:object_r:proc_t:s0 tclass=dir Expected results: The same as with -e container=docker, no AVC denial and no Mount failed for selinuxfs on /sys/fs/selinux: No such file or directory Failed to set up the root directory for shared mount propagation: Operation not permitted lines. Additional info: I was not able to see the same error (and AVC denial) with rhel7:7.4 image -- so # docker run --name systemd --rm -ti registry.access.redhat.com/rhel7:7.4 /usr/sbin/init works fine while running from fedora images (fedora:25, fedora:26, fedora:rawhide) fails.