Bug 1565946 - avc: denied { write } comm=systemd-sysctl name=ptrace_scope dev="proc" while doing "docker run"
Summary: avc: denied { write } comm=systemd-sysctl name=ptrace_scope dev="proc" whil...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: container-selinux
Version: 7.5
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lokesh Mandvekar
QA Contact: atomic-bugs@redhat.com
URL:
Whiteboard:
: 1565945 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-11 06:45 UTC by Václav Kadlčík
Modified: 2019-01-17 13:32 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-01-17 13:32:19 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Václav Kadlčík 2018-04-11 06:45:02 UTC
Description of problem:

I'm observing AVC denials while running "docker build" or
"docker run". I've minimized the case to just this command:

  docker run -ti --rm docker.io/fedora:27 dnf -y update elfutils-default-yama-scope

(currently it updates elfutils-default-yama-scope to
0.170-10.fc27 in the Fedora container)

ausearch -m avc gives:

type=PROCTITLE msg=audit(1523427485.147:34998): proctitle=2F7573722F6C69622F73797374656D642F73797374656D642D73797363746C0031302D64656661756C742D79616D612D73636F70652E636F6E66
type=SYSCALL msg=audit(1523427485.147:34998): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=7fff0eadadd0 a2=80101 a3=0 items=0 ppid=3778 pid=3781 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts5 ses=4294967295 comm="systemd-sysctl" exe="/usr/lib/systemd/systemd-sysctl" subj=system_u:system_r:container_t:s0:c286,c307 key=(null)
type=AVC msg=audit(1523427485.147:34998): avc:  denied  { write } for  pid=3781 comm="systemd-sysctl" name="ptrace_scope" dev="proc" ino=859883 scontext=system_u:system_r:container_t:s0:c286,c307 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file


Version-Release number of selected component (if applicable):

RHEL 7.5
  selinux-policy-3.13.1-192.el7.noarch
  kernel-3.10.0-862.el7.x86_64
  docker-1.13.1-58.git87f2fab.el7.x86_64


How reproducible:

Seems 100%


Steps to Reproduce:
1. Have Docker running
2. docker pull docker.io/fedora:27
3. docker run -ti --rm docker.io/fedora:27 dnf -y update elfutils-default-yama-scope
4. ausearch -m avc -ts today

Comment 2 Václav Kadlčík 2018-04-11 07:45:28 UTC
*** Bug 1565945 has been marked as a duplicate of this bug. ***

Comment 3 Daniel Walsh 2019-01-10 20:04:50 UTC
Did anything break?

I don't believe this is a namespaced sysctl, so this should not be allowed by default inside of containers.

Comment 4 Václav Kadlčík 2019-01-17 08:31:33 UTC
(In reply to Daniel Walsh from comment #3)
> Did anything break?

I haven't met this bug for months but IIRC, I didn't see
anything broken at the time

Comment 5 Daniel Walsh 2019-01-17 13:32:19 UTC
I added a dontaudit for this since the sysctl would fail even if SELinux allowed it, since the /proc/sys is mounted readonly.


Note You need to log in before you can comment on or make changes to this bug.