Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Not that the Git repository, including the build directory, is shared with Docker containers from time to time. That explains the labelling of the target file. SELinux is preventing abrt-action-gen from 'map' accesses on the file /home/lrineau/Git/cgal/build/lib/libCGAL.so.13.0.2. ***** Plugin httpd_unified (89.3 confidence) suggests ********************* If you want to allow httpd to execute cgi scripts and to unify HTTPD handling of all content files. Then you must tell SELinux about this by enabling the 'httpd_unified' and 'http_enable_cgi' booleans Do # setsebool -P httpd_unified=1 httpd_enable_cgi=1 ***** Plugin catchall (11.6 confidence) suggests ************************** If you believe that abrt-action-gen should be allowed map access on the libCGAL.so.13.0.2 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'abrt-action-gen' --raw | audit2allow -M my-abrtactiongen # semodule -X 300 -i my-abrtactiongen.pp Additional Information: Source Context system_u:system_r:abrt_t:s0-s0:c0.c1023 Target Context unconfined_u:object_r:container_file_t:s0:c588,c71 4 Target Objects /home/lrineau/Git/cgal/build/lib/libCGAL.so.13.0.2 [ file ] Source abrt-action-gen Source Path abrt-action-gen Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM <Unknown> Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.14.3-300.fc27.x86_64 #1 SMP Mon Dec 4 17:18:27 UTC 2017 x86_64 x86_64 Alert Count 4 First Seen 2017-12-13 16:30:11 CET Last Seen 2017-12-13 16:30:11 CET Local ID 081f9962-e7a9-4a2e-9d98-9e93e6a5a74d Raw Audit Messages type=AVC msg=audit(1513179011.337:549): avc: denied { map } for pid=13288 comm="eu-unstrip" path="/home/lrineau/Git/cgal/build/lib/libCGAL.so.13.0.2" dev="dm-1" ino=10884065 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:container_file_t:s0:c588,c714 tclass=file permissive=0 Hash: abrt-action-gen,abrt_t,container_file_t,file,map Additional info: component: selinux-policy reporter: libreport-2.9.3 hashmarkername: setroubleshoot kernel: 4.14.3-300.fc27.x86_64 type: libreport
I have now 1131 hits of that AVC in the "SETroubleshoot Alert List". It seems abrt is supposed to work on segfaults inside containers: https://github.com/abrt/abrt/wiki/Containers-and-chroots So certainly it is supposed to be allowed to map any container file.
This looks like you volume mounted in your homedir into a container and the relabeled it. This is not a good idea. restorecon -R -v -F ~/ Should fix the labels. If you want to use your complete homedir inside of a container you should disable SELinux with the --security-opt disable flag in either podman or docker.
OK, let's say I want to share a C++ code base (in a Git repository) between the host and Docker containers, because I am a developer and that is really convenient to be able to use Docker containers as services (for example to build AppImages targeting CentOS 6). For convenience, I can even move that repo outside of my HOME directory if that makes it easier. What would be the right SElinux type for such a directory? So far the SELinux guidelines say that is container_file_t. Note that I do not want to share my HOME directory. (I read your blog, and in particular https://danwalsh.livejournal.com/76016.html and I know what that could break.) But until recently (when the new SELinux 'map' issue popped up), that setup was working really fine. I found strange that Fedora does not support such a use case. You can also imaging a node.js developer sharing a Git working directory with a container via a volume, during the setting up of a new containerized application, and before hardcoding the code in the Docker image itself. I do not know if abrtd reports anything about node.js applications (well, replace "node.js" by "python").
Ok I don't think you did anything wrong. Why abrt is looking into your homedir for this content I don't know, unless it was noticing a container process crashing. Anyways that would be a selinux-policy issue, and should be fixed in abrt policy. Looks like we need to add policy about this.
Lukas we need to add the map permission to abrt to look at content that is labeled container_file_t.
selinux-policy-3.13.1-283.29.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ad9976b6a2
selinux-policy-3.13.1-283.29.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ad9976b6a2
selinux-policy-3.13.1-283.29.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.