Bug 1565945 - avc: denied { write } comm=systemd-sysctl name=ptrace_scope dev="proc" while doing "docker run"
Summary: avc: denied { write } comm=systemd-sysctl name=ptrace_scope dev="proc" whil...
Keywords:
Status: CLOSED DUPLICATE of bug 1565946
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.5
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-11 06:42 UTC by Václav Kadlčík
Modified: 2018-04-11 07:45 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-11 07:45:28 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Václav Kadlčík 2018-04-11 06:42:58 UTC
Description of problem:

I'm observing AVC denials while running "docker build" or
"docker run". I've minimized the case to just this command:

  docker run -ti --rm docker.io/fedora:27 dnf -y update elfutils-default-yama-scope

(currently it updates elfutils-default-yama-scope to
0.170-10.fc27 in the Fedora container)

ausearch -m avc gives:

type=PROCTITLE msg=audit(1523427485.147:34998): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C0031302D64656661756C742D79616D612D73636F70652E636F6E66
type=SYSCALL msg=audit(1523427485.147:34998): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=7fff0eadadd0 a2=80101 a3=0 items=0 ppid=3778 pid=3781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 ses=4294967295 comm="systemd-sysctl" exe="/usr/lib/systemd/systemd-sysctl" subj=system_u:system_r:container_t:s0:c286,c307 key=(null)
type=AVC msg=audit(1523427485.147:34998): avc:  denied  { write } for  pid=3781 comm="systemd-sysctl" name="ptrace_scope" dev="proc" ino=859883 scontext=system_u:system_r:container_t:s0:c286,c307 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file


Version-Release number of selected component (if applicable):

RHEL 7.5
  selinux-policy-3.13.1-192.el7.noarch
  kernel-3.10.0-862.el7.x86_64
  docker-1.13.1-58.git87f2fab.el7.x86_64


How reproducible:

Seems 100%


Steps to Reproduce:
1. Have Docker running
2. docker pull docker.io/fedora:27
3. docker run -ti --rm docker.io/fedora:27 dnf -y update elfutils-default-yama-scope
4. ausearch -m avc -ts today

Comment 1 Václav Kadlčík 2018-04-11 07:45:28 UTC

*** This bug has been marked as a duplicate of bug 1565946 ***


Note You need to log in before you can comment on or make changes to this bug.