Description of problem:

Selinux won't allow scpt communication in containers.


How reproducible:
Always

Steps to Reproduce:

I have two containers running inside an ocp cluster trying to communicate via sctp.
On client side I execute:

[root@sctpclient-8598b85d98-rgst7 /]# sctp_test -H localhost -P 30100 -h 10.129.0.33 -p 30100 -s
remote:addr=10.129.0.33, port=rwp, family=2
local:addr=::, port=rwp, family=10
seed = 1573058364

Starting tests...
	socket(SOCK_SEQPACKET, IPPROTO_SCTP)  ->  sk=3
	bind(sk=3, [a:::,p:rwp])  --  attempt 1/10


		***bind: can not bind to :::rwp: Permission denied ****

On server side:

[root@sctpserver-86c9c56484-pwjw9 /]# sctp_test -H localhost -P 30100 -l
local:addr=::, port=rwp, family=10
seed = 1573058322

Starting tests...
	socket(SOCK_SEQPACKET, IPPROTO_SCTP)  ->  sk=3
	bind(sk=3, [a:::,p:rwp])  --  attempt 1/10


		***bind: can not bind to :::rwp: Permission denied ****

Actual results:

Output of audit2why on the host:

type=AVC msg=audit(1573057500.176:79): avc:  denied  { node_bind } for  pid=54942 comm="sctp_test" src=30100 scontext=system_u:system_r:container_t:s0:c623,c666 tcontext=system_u:object_r:node_t:s0 tclass=sctp_socket permissive=1
type=AVC msg=audit(1573057500.177:80): avc:  denied  { listen } for  pid=54942 comm="sctp_test" lport=30100 scontext=system_u:system_r:container_t:s0:c623,c666 tcontext=system_u:system_r:container_t:s0:c623,c666 tclass=sctp_socket permissive=1
type=AVC msg=audit(1573057500.177:80): avc:  denied  { module_request } for  pid=54942 comm="sctp_test" kmod="crypto-hmac(sha1)" scontext=system_u:system_r:container_t:s0:c623,c666 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=1
type=AVC msg=audit(1573058322.702:90): avc:  denied  { name_bind } for  pid=119508 comm="sctp_test" src=30100 scontext=system_u:system_r:container_t:s0:c623,c666 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=sctp_socket permissive=0
type=AVC msg=audit(1573058364.617:91): avc:  denied  { name_bind } for  pid=122764 comm="sctp_test" src=30100 scontext=system_u:system_r:container_t:s0:c146,c880 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=sctp_socket permissive=0
type=AVC msg=audit(1573058373.960:92): avc:  denied  { name_bind } for  pid=123560 comm="sctp_test" src=30100 scontext=system_u:system_r:container_t:s0:c623,c666 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=sctp_socket permissive=0

Once adding a custom policy generated via audit2allow, I still have an error on client side:

[root@sctpclient-8598b85d98-rgst7 /]# sctp_test -H localhost -P 30100 -h 10.129.0.33 -p 30100 -s
remote:addr=10.129.0.33, port=rwp, family=2
local:addr=::, port=rwp, family=10
seed = 1573058557

Starting tests...
	socket(SOCK_SEQPACKET, IPPROTO_SCTP)  ->  sk=3
	bind(sk=3, [a:::,p:rwp])  --  attempt 1/10
Client: Sending packets.(1/10)
	sendmsg(sk=3, assoc=0)    1 bytes.
	  SNDRCV(stream=0 flags=0x1 ppid=1943840389

		*** sendmsg: Permission denied ***

Resulted by the subsequent filter on the host:

type=AVC msg=audit(1573058557.794:95): avc:  denied  { name_connect } for  pid=137935 comm="sctp_test" dest=30100 scontext=system_u:system_r:container_t:s0:c146,c880 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=sctp_socket permissive=0


After re-generating the custom policy adding this last one, the client and the server are able to communicate.


Expected results:

Works with no need to add custom selinux policy