Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: This SEAlert is triggered everytime I run: docker run --privileged -d -p 8443:443 manageiq/manageiq:fine-4 SELinux is preventing oci-systemd-hoo from using the 'mac_admin' capabilities. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that oci-systemd-hoo should have the mac_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'oci-systemd-hoo' --raw | audit2allow -M my-ocisystemdhoo # semodule -X 300 -i my-ocisystemdhoo.pp Additional Information: Source Context system_u:system_r:container_runtime_t:s0 Target Context system_u:system_r:container_runtime_t:s0 Target Objects Unknown [ capability2 ] Source oci-systemd-hoo Source Path oci-systemd-hoo Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-283.19.fc27.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.14.11-300.fc27.x86_64 #1 SMP Wed Jan 3 13:52:28 UTC 2018 x86_64 x86_64 Alert Count 13 First Seen 2018-01-04 13:52:55 EST Last Seen 2018-01-04 13:52:55 EST Local ID 0725d9b9-367a-4f5f-acb7-e2db63a235ee Raw Audit Messages type=AVC msg=audit(1515091975.494:380): avc: denied { mac_admin } for pid=5358 comm="oci-systemd-hoo" capability=33 scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=capability2 permissive=0 Hash: oci-systemd-hoo,container_runtime_t,container_runtime_t,capability2,mac_admin Version-Release number of selected component: selinux-policy-3.13.1-283.19.fc27.noarch Additional info: component: selinux-policy reporter: libreport-2.9.3 hashmarkername: setroubleshoot kernel: 4.14.11-300.fc27.x86_64 type: libreport
This looks like container-selinux is not installed? Do you continue to see this issue?
Sorry, my bugzilla notification got lost in my inbox. The package you mentioned is installed: $ rpm -qe container-selinux container-selinux-2.48-1.fc27.noarch and I still get this error. I just built my desktop and laptop from zero with latest Fedora updates. Below is the latest info: SELinux is preventing oci-systemd-hoo from using the mac_admin capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that oci-systemd-hoo should have the mac_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'oci-systemd-hoo' --raw | audit2allow -M my-ocisystemdhoo # semodule -X 300 -i my-ocisystemdhoo.pp Additional Information: Source Context system_u:system_r:container_runtime_t:s0 Target Context system_u:system_r:container_runtime_t:s0 Target Objects Unknown [ capability2 ] Source oci-systemd-hoo Source Path oci-systemd-hoo Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-283.24.fc27.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.15.4-300.fc27.x86_64 #1 SMP Mon Feb 19 23:31:15 UTC 2018 x86_64 x86_64 Alert Count 13 First Seen 2018-02-27 15:02:31 EST Last Seen 2018-02-27 15:02:31 EST Local ID 092bb745-4dff-4c77-979c-74a1d29f191f Raw Audit Messages type=AVC msg=audit(1519761751.676:2064): avc: denied { mac_admin } for pid=26997 comm="oci-systemd-hoo" capability=33 scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=capability2 permissive=0 Hash: oci-systemd-hoo,container_runtime_t,container_runtime_t,capability2,mac_admin
Do you have container-selinux installed? dnf reinstall container-selinux Do you have the virt policy enabled?
Just reinstalled container-linux and the problem persists. What virt policy are you talking about? These are the current virt policies I have set in my system: $ getsebool -a | grep virt staff_use_svirt --> off unprivuser_use_svirt --> off virt_read_qemu_ga_data --> off virt_rw_qemu_ga_data --> off virt_sandbox_share_apache_content --> off virt_sandbox_use_all_caps --> on virt_sandbox_use_audit --> on virt_sandbox_use_fusefs --> off virt_sandbox_use_mknod --> off virt_sandbox_use_netlink --> off virt_sandbox_use_sys_admin --> off virt_transition_userdomain --> off virt_use_comm --> off virt_use_execmem --> off virt_use_fusefs --> off virt_use_glusterd --> off virt_use_nfs --> on virt_use_pcscd --> off virt_use_rawip --> off virt_use_samba --> off virt_use_sanlock --> off virt_use_usb --> on virt_use_xserver --> off I can run other containers with '--privileged' mode and I don't get this alert. I think this problem is related to what the ManageIQ container is trying to do in the host. Once the instruction [1] says we have to run it by lifting all the limitations enforced by the device cgroup controller ('--privileged'), it is probably trying to do something that the host is not allowing it to do. Could it be the case? [1] - http://manageiq.org/docs/get-started/docker Also,: ManageIQ Dockerfile: https://github.com/ManageIQ/manageiq/blob/master/Dockerfile
mac_admin means that the process is trying to use a label that the SELinux kernel does not understand. Could you see if their are any other records in the audit.log around this AVC? In the journal do you see an error like pr_perror("%s: Failed to set context %s on %s", id, label, full_path); or pr_perror("%s: Failed to set journal dir selinux context", id);
Created attachment 1401946 [details] journal log This is the log I see at the moment I run the container and get the SELinux warnings.
Created attachment 1401948 [details] audit log This is all I see for mac_admin within the audit log.
Does this name missing the last character means anything? "oci-systemd-hoo" Is this a limitation imposed by the system or it is a typo? I would expect: "oci-systemd-hook"
Ok it is trying to set the context to "", which is obviously not valid. oci-systemd-hook should just check for this and do nothing.
Is your system running with selinux disabled? Is docker running with SELinux disabled?
SELinux in enforcing mode and I haven't made any changes in the docker config to run with SELinux. The installation was done exactly like it describes here [1], I also added my user into docker group so I don't run docker with sudo. [1] - https://developer.fedoraproject.org/tools/docker/docker-installation.html
Sorry, I meant I didn't change anything in the docker config to run _without_ SELinux.
Very strange I have never seen this before.
Let me know if you need anything else or if you need me to run any test.
Description of problem: Not sure what causes this. Version-Release number of selected component: selinux-policy-3.13.1-283.26.fc27.noarch Additional info: reporter: libreport-2.9.3 hashmarkername: setroubleshoot kernel: 4.15.6-300.fc27.x86_64 type: libreport
Description of problem: Not sure what caused this. Version-Release number of selected component: selinux-policy-3.13.1-283.26.fc27.noarch Additional info: reporter: libreport-2.9.3 hashmarkername: setroubleshoot kernel: 4.15.6-300.fc27.x86_64 type: libreport
Having looked through this bug, I can also confirm: $ sudo dnf install container-selinux Package container-selinux-2:2.48-1.fc27.noarch is already installed, skipping. Dependencies resolved. Nothing to do. Complete!
Brian are you saying you are seeing this same issue?
@Daniel: Yes, I am: SELinux is preventing oci-systemd-hoo from using the mac_admin capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that oci-systemd-hoo should have the mac_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'oci-systemd-hoo' --raw | audit2allow -M my-ocisystemdhoo # semodule -X 300 -i my-ocisystemdhoo.pp Additional Information: Source Context system_u:system_r:container_runtime_t:s0 Target Context system_u:system_r:container_runtime_t:s0 Target Objects Unknown [ capability2 ] Source oci-systemd-hoo Source Path oci-systemd-hoo Port <Unknown> Host laptop.example.com Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-283.26.fc27.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name laptop.example.com Platform Linux laptop.example.com 4.15.6-300.fc27.x86_64 #1 SMP Mon Feb 26 18:43:03 UTC 2018 x86_64 x86_64 Alert Count 13 First Seen 2018-03-12 10:45:50 EDT Last Seen 2018-03-12 10:45:50 EDT Local ID abc8a78b-cd34-4282-924e-6523a2d5d2a5 Raw Audit Messages type=AVC msg=audit(1520865950.244:70743): avc: denied { mac_admin } for pid=23303 comm="oci-systemd-hoo" capability=33 scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=capability2 permissive=0 Hash: oci-systemd-hoo,container_runtime_t,container_runtime_t,capability2,mac_admin
And you are running a systemd based container? Are there any other lines in the audit.log with this AVC. ausearch -m avc -ts recent
If you mean, am I starting a container that runs systemd inside of it, then yes: docker run --privileged -d -i -e "container=docker" -v /sys/fs/cgroup:/sys/fs/cgroup -v "$(pwd)":"$MAPPED_DIR":rw centos:centos7 /usr/sbin/init DOCKER_CONTAINER_ID=$(docker ps | grep centos | awk 'NR==1{print $1}') trap 'set -x docker stop "$DOCKER_CONTAINER_ID" docker rm -v "$DOCKER_CONTAINER_ID"' EXIT docker logs "$DOCKER_CONTAINER_ID" docker exec -i "$DOCKER_CONTAINER_ID" /bin/bash -xec "cd $MAPPED_DIR; $*" As a general "run something in a centos7 container" wrapper. $ sudo ausearch -m avc -ts recent <no matches>
So in this case you did not get the MAC_ADMIN error?
Which case? All of the cases above that I have posted here have been from the SELinux Alert Browser.
We have another bug just like this one. Did you see any other messages associated with the MAC Admin to indicate which label is attempting to be put down. The other bugzilla like this was trying to put down tzdata_exec_t. Which looked like for some reason the SELinux policy database was screwed up. Since Docker new nothing about that label. I recommended that the user do the following to see if it cleared up their problem. # setenforce 0 # rm -rf /etc/selinux/targeted # dnf reinstall selinux-policy selinux-policy-targeted container-selinux # restorecon -R -v /etc/selinux # setenforce 0 # systemctl restart docker And try your container.
So I realize that I am going to make a mess of things, but here is some data from: CentOS7 -- container-selinux-2.55-1.el7.noarch libselinux-2.5-12.el7.x86_64 libselinux-python-2.5-12.el7.x86_64 libselinux-utils-2.5-12.el7.x86_64 selinux-policy-3.13.1-192.el7_5.3.noarch selinux-policy-targeted-3.13.1-192.el7_5.3.noarch oci-register-machine-0-6.git2b44233.el7.x86_64 oci-systemd-hook-0.1.15-2.gitc04483d.el7.x86_64 oci-umount-2.3.3-3.gite3c9055.el7.x86_64 Using podman podman-0.6.2-1.git72c0b4f.el7.x86_64 --- # ausearch -m avc -ts recent ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.241:128): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.241:128): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6c40 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.241:128): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.241:128): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.242:129): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.242:129): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6c40 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.242:129): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.242:129): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.257:130): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.257:130): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.257:130): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.257:130): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.257:131): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.257:131): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.257:131): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.257:131): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.258:132): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.258:132): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.258:132): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.258:132): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.258:133): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.258:133): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.258:133): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.258:133): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.259:134): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.259:134): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.259:134): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.259:134): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.259:135): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.259:135): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.259:135): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.259:135): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.259:136): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.259:136): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.259:136): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.259:136): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.260:137): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.260:137): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.260:137): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.260:137): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.260:138): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.260:138): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.260:138): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.260:138): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.261:139): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.261:139): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.261:139): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.261:139): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.261:140): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.261:140): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6cd0 a1=7f8f1731beaa a2=1fd6e10 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.261:140): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.261:140): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.261:141): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.261:141): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.261:141): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.261:141): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.262:142): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.262:142): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.262:142): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.262:142): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.262:143): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.262:143): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e90 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.262:143): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.262:143): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.263:144): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.263:144): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.263:144): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.263:144): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.264:145): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.264:145): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.264:145): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.264:145): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.264:146): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.264:146): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.264:146): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.264:146): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.264:147): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.264:147): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.264:147): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.264:147): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.265:148): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.265:148): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.265:148): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.265:148): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.265:149): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.265:149): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.265:149): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.265:149): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.266:150): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.266:150): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.266:150): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.266:150): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.266:151): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.266:151): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.266:151): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.266:151): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 ---- time->Sat Jun 16 21:53:22 2018 type=PROCTITLE msg=audit(1529200402.266:152): proctitle="/usr/libexec/oci/hooks.d/oci-systemd-hook" type=SYSCALL msg=audit(1529200402.266:152): arch=c000003e syscall=188 success=no exit=-22 a0=1fd6e10 a1=7f8f1731beaa a2=1fa63b0 a3=1 items=0 ppid=12903 pid=12923 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="oci-systemd-hoo" exe="/usr/libexec/oci/hooks.d/oci-systemd-hook" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) type=SELINUX_ERR msg=audit(1529200402.266:152): op=setxattr invalid_context="" type=AVC msg=audit(1529200402.266:152): avc: denied { mac_admin } for pid=12923 comm="oci-systemd-hoo" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 --- Also, in the journal: --- Jun 16 21:52:58 dumpster.festive.local kernel: TECH PREVIEW: Overlay filesystem may not be fully supported. Please review provided documentation for limitations. Jun 16 21:53:22 dumpster.festive.local conmon[12902]: conmon 945f62748ba41a0af8bd <ninfo>: about to waitpid: 12903 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: rootfs=/var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: gidMappings not found in config Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: GID: 0 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: uidMappings not found in config Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: UID: 0 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 11:blkio:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :blkio:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 10:devices:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :devices:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 9:pids:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :pids:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 8:cpuset:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :cpuset:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 7:freezer:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :freezer:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 6:hugetlb:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :hugetlb:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 5:perf_event:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :perf_event:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 4:memory:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :memory:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: Found cgroup Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: PATH: /libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: SUBSYSTEM_PATH: /sys/fs/cgroup/memory/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: memory path: /sys/fs/cgroup/memory/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/memory.limit_in_bytes Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: LIMIT: 9223372036854771712 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: Limit in bytes: 9223372036854771712 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged/var/log/journal/945f62748ba4/.: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged/var/log/journal/945f62748ba4/..: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: /sys/fs/cgroup already present as a mount point in container configuration, skipping Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 11:blkio:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :blkio:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 10:devices:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :devices:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 9:pids:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :pids:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 8:cpuset:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :cpuset:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 7:freezer:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :freezer:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 6:hugetlb:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :hugetlb:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 5:perf_event:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :perf_event:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 4:memory:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :memory:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 3:cpuacct,cpu:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :cpuacct,cpu:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 2:net_prio,net_cls:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :net_prio,net_cls:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 1:name=systemd:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr : 945f62748ba4 Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: :name=systemd:/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: Found cgroup Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: PATH: /libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <debug>: 945f62748ba4: SUBSYSTEM_PATH: /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/.: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/..: Read-only file system Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/libpod_parent: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/user.slice: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/system.slice: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/release_agent: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/cgroup.sane_behavior: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/cgroup.clone_children: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/cgroup.event_control: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/notify_on_release: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/cgroup.procs: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged//sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/tasks: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/.: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/..: Invalid argument Jun 16 21:53:22 dumpster.festive.local dbus[798]: [system] Activating service name='org.fedoraproject.Setroubleshootd' (using servicehelper) Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/libpod_parent: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/user.slice: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/system.slice: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/release_agent: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/cgroup.sane_behavior: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/cgroup.clone_children: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/cgroup.event_control: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/notify_on_release: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/cgroup.procs: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-systemd-hook[12923]: systemdhook <error>: 945f62748ba4: Failed to set context on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/tasks: Invalid argument Jun 16 21:53:22 dumpster.festive.local oci-umount[12926]: umounthook <debug>: prestart container_id:945f62748ba4 rootfs:/var/lib/containers/storage/overlay/6b0599e5eee1e0ab0bd6309d3b491582cc86b6927f0b55dd0bb456f5080b6690/merged Jun 16 21:53:22 dumpster.festive.local conmon[12902]: conmon 945f62748ba41a0af8bd <ninfo>: container PID: 12912 Jun 16 21:53:22 dumpster.festive.local conmon[12902]: conmon 945f62748ba41a0af8bd <ninfo>: attach sock path: /var/run/libpod/socket/945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/attach Jun 16 21:53:22 dumpster.festive.local conmon[12902]: conmon 945f62748ba41a0af8bd <ninfo>: addr{sun_family=AF_UNIX, sun_path=/var/run/libpod/socket/945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/attach} Jun 16 21:53:22 dumpster.festive.local conmon[12902]: conmon 945f62748ba41a0af8bd <ninfo>: ctl fifo path: /var/lib/containers/storage/overlay-containers/945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/userdata/ctl ---
Could this be related to https://github.com/projectatomic/libpod/issues/836 ? cgroup on /sys/fs/cgroup/systemd/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr/libpod_parent/libpod-945f62748ba41a0af8bd43d8e23f7bac3d3a17e29f85daa957dcaef0ee9d21ff/ctr type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
This should fix the issue. https://github.com/projectatomic/oci-systemd-hook/pull/97
oci-systemd-hook-0.1.17-1.git87fb61e.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ec65ab12de
oci-systemd-hook-0.1.17-1.git87fb61e.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ce3a2f9c17
oci-systemd-hook-0.1.17-1.git87fb61e.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ec65ab12de
oci-systemd-hook-0.1.17-1.git87fb61e.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ce3a2f9c17
I don't see problem anymore after installing 0.1.17-1.git87fb61e on F27 (original scenario) and also I don't see this problem on the F28.
oci-systemd-hook-0.1.17-1.git87fb61e.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
oci-systemd-hook-0.1.17-1.git87fb61e.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.