Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1625772

Summary:	Failed to resolve allow statement
Product:	Red Hat Enterprise Linux 7	Reporter:	Qian Cai <qcai>
Component:	container-selinux	Assignee:	Frantisek Kluknavsky <fkluknav>
Status:	CLOSED ERRATA	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.5	CC:	dwalsh, fkluknav, walters, ypu
Target Milestone:	rc	Keywords:	Extras, Regression
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-10-30 11:54:25 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Qian Cai 2018-09-05 20:04:29 UTC

Description of problem:
container-selinux-2.69-2.el7.noarch introduced a regression that it simply failed to load container module. Probably due to this commit.

https://github.com/containers/container-selinux/commit/a4493c674b01bb817bb3dbc43e90fbfba8797e75

# semodule -X200 -i /usr/share/selinux/packages/container.pp.bz2
Failed to resolve allow statement at /etc/selinux/targeted/tmp/modules/200/container/cil:1108
semodule:  Failed!

Even worse, the rpm still report installation successfully, so ideally, the spec file need to fix to bail out for this sort of "semodule -i" errors, so people could catch this in the first place rather than later when running podman which could waste lots of cycles to debug.

# yum -y install container-selinux
...
Running transaction
Warning: RPMDB altered outside of yum.
  Installing : 2:container-selinux-2.69-2.el7.noarch                                                                                                                                                           1/1 
Failed to resolve allow statement at /etc/selinux/targeted/tmp/modules/200/container/cil:1108
/usr/sbin/semodule:  Failed!
  Verifying  : 2:container-selinux-2.69-2.el7.noarch                                                                                                                                                           1/1 

Installed:
  container-selinux.noarch 2:2.69-2.el7                                                                                                                                                                            

Complete!

Version-Release number of selected component (if applicable):
RHEL-7.5.4

How reproducible:
always

Comment 1 Qian Cai 2018-09-05 20:51:16 UTC

Well, with the above commit, it won't be compiled from a RHEL-7.5.4 system.

# git reset --hard origin/RHEL7.5
HEAD is now at 668a836 Dontaudit attempts to write to kernel sysctls

# make
make -f /usr/share/selinux/devel/Makefile container.pp
make[1]: Entering directory `/root/container-selinux'
Compiling targeted container module
/usr/bin/checkmodule:  loading policy configuration from tmp/container.tmp
container.te:473:ERROR 'permission map is not defined for class file' at token ';' on line 18652:
#line 473
    allow svirt_sandbox_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
container.te:473:ERROR 'permission map is not defined for class dir' at token ';' on line 18652:
#line 473
    allow svirt_sandbox_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
container.te:473:ERROR 'permission map is not defined for class lnk_file' at token ';' on line 18652:
#line 473
    allow svirt_sandbox_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
container.te:473:ERROR 'permission map is not defined for class chr_file' at token ';' on line 18652:
#line 473
    allow svirt_sandbox_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
container.te:473:ERROR 'permission map is not defined for class blk_file' at token ';' on line 18652:
#line 473
    allow svirt_sandbox_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
container.te:473:ERROR 'permission map is not defined for class sock_file' at token ';' on line 18652:
#line 473
    allow svirt_sandbox_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
container.te:473:ERROR 'permission map is not defined for class fifo_file' at token ';' on line 18652:
#line 473
    allow svirt_sandbox_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
container.te:648:ERROR 'permission map is not defined for class fifo_file' at token ';' on line 27402:
allow container_runtime_t container_domain:fifo_file { open { getattr read write append ioctl lock } };
allow container_domain container_runtime_t:fifo_file { { open { getattr read write append ioctl lock } } map };
container.te:651:ERROR 'permission map is not defined for class tcp_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class udp_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class rawip_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class packet_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class unix_stream_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class unix_dgram_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_route_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_firewall_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_tcpdiag_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_nflog_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_xfrm_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_selinux_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_audit_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_ip6fw_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_dnrt_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_kobject_uevent_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class appletalk_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class dccp_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class tun_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_iscsi_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_fib_lookup_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_connector_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_netfilter_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_generic_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_scsitransport_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_rdma_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:651:ERROR 'permission map is not defined for class netlink_crypto_socket' at token ';' on line 27405:
allow container_domain self:{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_sock
allow container_runtime_t container_domain:fd use;
container.te:689:ERROR 'permission map is not defined for class file' at token ';' on line 27525:
allow container_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
 	
container.te:689:ERROR 'permission map is not defined for class dir' at token ';' on line 27525:
allow container_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
 	
container.te:689:ERROR 'permission map is not defined for class lnk_file' at token ';' on line 27525:
allow container_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
 	
container.te:689:ERROR 'permission map is not defined for class chr_file' at token ';' on line 27525:
allow container_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
 	
container.te:689:ERROR 'permission map is not defined for class blk_file' at token ';' on line 27525:
allow container_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
 	
container.te:689:ERROR 'permission map is not defined for class sock_file' at token ';' on line 27525:
allow container_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
 	
container.te:689:ERROR 'permission map is not defined for class fifo_file' at token ';' on line 27525:
allow container_domain container_file_t:{ dir file lnk_file sock_file fifo_file chr_file blk_file } { relabelfrom relabelto map };
 	
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make[1]: *** [tmp/container.mod] Error 1
make[1]: Leaving directory `/root/container-selinux'
make: *** [container.pp] Error 2

Comment 2 Daniel Walsh 2018-09-06 10:42:19 UTC

This policy is only supposed to be in rhel7.6.  If it is getting pulled into rhel7.5.4 then we need to also pull in the latest selinux-policy with it.

Comment 3 Daniel Walsh 2018-09-06 10:54:59 UTC

container-selinux-2.69-3.el7 should force in the correct selinux-policy package.

Comment 4 Qian Cai 2018-09-06 12:20:47 UTC

I really don't understand how this was pulled into RHEL-7.5.4.

http://download-node-02.eng.bos.redhat.com/rel-eng/latest-EXTRAS-7.5-RHEL-7/compose/Server/ppc64le/os/Packages/container-selinux-2.69-2.el7.noarch.rpm

Comment 5 Qian Cai 2018-09-06 12:24:12 UTC

Even if container-selinux-2.69-3.el7 was pulled into RHEL-7.5 extras, it isn't going to work as selinux-policy in RHEL-7.5.4 won't be the version it required, so simply result in failing to install.

Comment 6 Daniel Walsh 2018-09-06 14:27:29 UTC

I am trying to update the version of selinux-policy that container-selinux requires so it will pull in the update if this happens.

Comment 8 Colin Walters 2018-09-06 14:52:19 UTC

> Since there will be only single extras repos for RHEL-7 shared by both 7.5.4 and 7.6, 

This is such a core problem.  Our tooling in general has huge gaps in handling branching, yet we do so much of it.  It's mostly OK for base RHEL, but the branching is a much greater cost for everything built on top (Extras, OCP, etc.)

Comment 9 Qian Cai 2018-09-06 18:23:30 UTC

BTW, I opened bug 1626215 to track spec file issues, so it could help debugging if this happens again in the future.

Comment 11 Joy Pu 2018-09-26 14:13:51 UTC

Can reproduce this with given container-selinux and selinux-policy-3.13.1-192.el7_5.3.noarch in 7.5.4. And container-selinux-2.73-2.el7.noarch request selinux-policy version >= 3.13.1-216. So test with container-selinux-2.73-2.el7.noarch and selinux-policy-3.13.1-225.el7.noarch:
# semodule -X200 -i /usr/share/selinux/packages/container.pp.bz2
semodule -X200 -i /usr/share/selinux/packages/container.pp.bz2 

The command finished as expect. So set this to verified.

Comment 13 errata-xmlrpc 2018-10-30 11:54:25 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3369

Comment 14 Red Hat Bugzilla 2023-09-14 04:34:17 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days