Description of problem:

The kernel returns EACCES when trying to write an empty value to /proc/self/attr/keycreate. According to Dan Walsh, writing an empty value is legitimate way to tell "reset it to whatever defaults are there", and yet the kernel returns an error. I believe this is a bug.

Here's a repro and how it works:

[root@kir-ce7-selinux-01 ~]# cat a.c 
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>

int main(void) {
	int fd, r;

	fd = open("/proc/self/attr/keycreate", O_WRONLY);
	if (fd < 0) {
		perror("open");
	}

	r = write(fd, "", 0);
	if (r < 0) {
		perror("write");
	}

	return 0;
}

[root@kir-ce7-selinux-01 ~]# uname -a
Linux kir-ce7-selinux-01 3.10.0-957.12.2.el7.x86_64 #1 SMP Tue May 14 21:24:32 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

[root@kir-ce7-selinux-01 ~]# gcc -Wall -O2 -o a a.c

[root@kir-ce7-selinux-01 ~]# ./a
write: Permission denied
[root@kir-ce7-selinux-01 ~]# strace ./a
...
open("/proc/self/attr/keycreate", O_WRONLY) = 3
write(3, "", 0)                         = -1 EACCES (Permission denied)
...


NOTE you need a freshly booted kernel for that. Something like yum update container-selinux makes the bug disappear (I suspect something in the post-install scripts resets the selinux state in the kernel or something).

Version-Release number of selected component (if applicable):

[root@kir-ce7-selinux-01 ~]# uname -a
Linux kir-ce7-selinux-01 3.10.0-957.12.2.el7.x86_64 #1 SMP Tue May 14 21:24:32 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux


How reproducible:

See above. NOTE you need a freshly booted kernel for that. Something like yum update container-selinux makes the bug disappear (I suspect something in the post-install scripts resets the selinux state in the kernel or something).

Actual results:

See above (EACCES returned from write).


Expected results:

No error.

Additional info:

This breaks runc, containerd, and docker :)