Bug 1565752 - docker + devmapper: wrong selinux labels
Summary: docker + devmapper: wrong selinux labels
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: container-selinux
Version: 7.5
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lokesh Mandvekar
QA Contact: atomic-bugs@redhat.com
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-10 16:47 UTC by Ed Santiago
Modified: 2020-05-05 14:36 UTC (History)
2 users (show)

Fixed In Version: container-selinux-2.56-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-05-05 14:36:40 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Ed Santiago 2018-04-10 16:47:54 UTC
Setup: docker-1.13 configured to use device mapper. Problem does not happen on overlay2 configurations.

Symptom:

  # docker run --rm --security-opt label:disable rhel7 cat /proc/self/attr/current
  system_u:system_r:container_runtime_t:s0
                    ^^^^^^^^^^^^^^^^^^^ -- expected spc_t

  # docker run --rm --privileged --userns=host rhel7 cat /proc/self/attr/current
  system_u:system_r:container_runtime_t:s0
                    ^^^^^^^^^^^^^^^^^^^ -- ditto


Seeing this on RHEL 7.4 and 7.5 with:

  container-selinux-2.55-1.el7.noarch
  docker-1.13.1-58.git87f2fab.el7.x86_64
  docker-1.13.1-61.git87f2fab.el7.x86_64

This is a regression since container-selinux-2.41-1.git126c1c0.el7 and docker-1.13.1-53.git774336d.el7

Comment 2 Daniel Walsh 2018-04-11 05:45:33 UTC
Works with Overlay2 Back end?

I think the problem is we might have dropped the transition from unlabeled_t.

Comment 3 Daniel Walsh 2018-04-11 05:51:47 UTC
Should be fixed in container-selinux-2.56-1.el7

Comment 4 Ed Santiago 2018-04-11 11:49:21 UTC
Confirmed.


Note You need to log in before you can comment on or make changes to this bug.