Description of problem: SELinux is preventing chown from 'setattr' accesses on the fifo_file . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that chown should be allowed setattr access on the fifo_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'chown' --raw | audit2allow -M my-chown # semodule -X 300 -i my-chown.pp Additional Information: Source Context system_u:system_r:spc_t:s0 Target Context system_u:system_r:container_runtime_t:s0 Target Objects [ fifo_file ] Source chown Source Path chown Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-283.24.fc27.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.14.16-300.fc27.x86_64 #1 SMP Wed Jan 31 19:24:27 UTC 2018 x86_64 x86_64 Alert Count 4 First Seen 2018-02-09 19:15:56 GMT Last Seen 2018-02-11 18:29:43 GMT Local ID 3298e3cc-3ced-465f-922b-b2cb13a2d2ee Raw Audit Messages type=AVC msg=audit(1518373783.378:446): avc: denied { setattr } for pid=17525 comm="chown" name="" dev="pipefs" ino=261170 scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=fifo_file permissive=0 Hash: chown,spc_t,container_runtime_t,fifo_file,setattr Version-Release number of selected component: selinux-policy-3.13.1-283.24.fc27.noarch Additional info: component: selinux-policy reporter: libreport-2.9.3 hashmarkername: setroubleshoot kernel: 4.15.6-300.fc27.x86_64 type: libreport Potential duplicate: bug 1488511
I have the same issue when starting mongodb on docker: docker run --rm -p 27017:27017 mongo I get this chown: changing ownership of '/proc/1/fd/1': Permission denied chown: changing ownership of '/proc/1/fd/2': Permission denied My policy RPM is selinux-policy-3.13.1-283.26.fc27.noarch instead. Not sure if this could be helpful, but here's a `ls -lZ /proc/1/fd`: lrwx------. 1 root root system_u:system_r:init_t:s0 64 Mar 12 10:46 0 -> /dev/null lrwx------. 1 root root system_u:system_r:init_t:s0 64 Mar 12 10:46 1 -> /dev/null
*** Bug 1488511 has been marked as a duplicate of this bug. ***
What AVC's are you seeing? And is this causing any issues other then the log messages? ausearch -m avc -ts recent
In my case, I am not experiencing any issue and mongodb appears to run fine, but I am using very limited functionalities right now. After running mongo in a new container `ausearch -m avc -ts recent` prints ---- time->Mon Mar 12 15:24:11 2018 type=AVC msg=audit(1520864651.203:1827): avc: denied { setattr } for pid=16375 comm="chown" name="" dev="pipefs" ino=622633 scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=fifo_file permissive=0 ---- time->Mon Mar 12 15:24:11 2018 type=AVC msg=audit(1520864651.203:1826): avc: denied { setattr } for pid=16375 comm="chown" name="" dev="pipefs" ino=622632 scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=fifo_file permissive=0
Fixed in container-selinux-2.54
container-selinux-2.55-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-29bc3c6098
container-selinux-2.55-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-cdf686cb83
container-selinux-2.55-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-29bc3c6098
container-selinux-2.55-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-cdf686cb83
container-selinux-2.55-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
I am using container-selinux-2.55-1.fc27, but I am still experiencing the issue. Besides updating, are there any additional steps to be performed? When running MongoDB, I get the following warning (apparently, it runs fine beside this) chown: changing ownership of '/proc/1/fd/1': Permission denied chown: changing ownership of '/proc/1/fd/2': Permission denied And I get the following selinux message: SELinux is preventing chown from setattr access on the fifo_file . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that chown should be allowed setattr access on the fifo_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'chown' --raw | audit2allow -M my-chown # semodule -X 300 -i my-chown.pp Additional Information: Source Context system_u:system_r:spc_t:s0 Target Context system_u:system_r:container_runtime_t:s0 Target Objects [ fifo_file ] Source chown Source Path chown Port <Unknown> Host sanctuary Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-283.29.fc27.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name sanctuary Platform Linux sanctuary 4.15.12-301.fc27.x86_64 #1 SMP Thu Mar 22 19:25:27 UTC 2018 x86_64 x86_64 Alert Count 14 First Seen 2018-03-26 15:30:16 CEST Last Seen 2018-03-28 11:19:26 CEST Local ID 96607e77-d9ea-4d52-84f7-50a5bf684c41 Raw Audit Messages type=AVC msg=audit(1522228766.581:351): avc: denied { setattr } for pid=15047 comm="chown" name="" dev="pipefs" ino=160788 scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=fifo_file permissive=0 Hash: chown,spc_t,container_runtime_t,fifo_file,setattr # ausearch -m avc -ts recent ---- time->Wed Mar 28 11:17:31 2018 type=AVC msg=audit(1522228651.112:320): avc: denied { setattr } for pid=14768 comm="chown" name="" dev="pipefs" ino=156705 scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=fifo_file permissive=0 ---- time->Wed Mar 28 11:17:31 2018 type=AVC msg=audit(1522228651.113:321): avc: denied { setattr } for pid=14768 comm="chown" name="" dev="pipefs" ino=156706 scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:container_runtime_t:s0 tclass=fifo_file permissive=0 ----
Sorry! I was mistaken: I was using docker-engine-selinux, not container-selinux. I removed the former and replaced it with the latter and issue is gone. Thanks and sorry again.
container-selinux-2.55-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.