RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1991443 - [RHEL 8.4] Backport container-selinux policy to allow spc_t domains to set bpf rules on any domain
Summary: [RHEL 8.4] Backport container-selinux policy to allow spc_t domains to set bp...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: selinux-policy
Version: 8.4
Hardware: All
OS: Linux
medium
high
Target Milestone: beta
: 8.6
Assignee: Zdenek Pytela
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On: 1961728 1965985
Blocks: 2011878 2015845 2015846
TreeView+ depends on / blocked
 
Reported: 2021-08-09 07:29 UTC by Itamar Holder
Modified: 2022-05-10 16:23 UTC (History)
10 users (show)

Fixed In Version: selinux-policy-3.14.3-81.el8
Doc Type: Bug Fix
Doc Text:
Cause: The policy does not allow super privileged containers set bpf rules on other domains. Consequence: Kubernetes does not fully operate with cgroups v2. Fix: The rule to allow the unconfined_domain_type attribute to set bpf rules on other domains was added to the policy. Result: Kubernetes operate fully with cgroups v2.
Clone Of: 1961728
: 2011878 2015845 2015846 (view as bug list)
Environment:
Last Closed: 2022-05-10 15:15:05 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-92851 0 None None None 2021-08-09 07:32:53 UTC
Red Hat Product Errata RHBA-2022:1995 0 None None None 2022-05-10 15:15:23 UTC

Description Itamar Holder 2021-08-09 07:29:15 UTC 
I am trying to fully support cgroups v2 on Kubevirt.


Description of problem:

Currently supporting cgroups v2 on Kubernetes with container-selinux is not possible due to the fact that "spc_t" (tag for Super Privileged Containers which are meant to have permissions to control the host) is not permitted to use BPF programs. This is a problem since in cgroups v2 the devices subsystem is no longer implemented though a file-system interface but with eBPF programs.

For this reason this PR was merged into container-selinux to allow spc_t domains to set bpf rules on any domain [1].

We also have a PR in Kubevirt [2] which is now blocked until we're affected by the changes. For this change to affect us in Kubevirt we need this change to be backported to RHEL 8.4.

[1] https://github.com/containers/container-selinux/pull/138
[2] https://github.com/kubevirt/kubevirt/pull/6042
Comment 1 Zdenek Pytela 2021-08-09 07:50:50 UTC 
Seems this is the commit to backport:

commit 74e737596525407e600f63c0ba4f4df65d5766cd
Author: Daniel J Walsh <dwalsh>
Date:   Fri Jul 16 06:32:34 2021 -0400

    Allow unconfined domains to bpf all other domains

    Signed-off-by: Daniel J Walsh <dwalsh>

diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index 3bea1857f..fb3259a13 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -255,7 +255,7 @@ optional_policy(`
 # be used on an attribute.

 # Use bpf tools
-allow unconfined_domain_type self:bpf { map_create map_read map_write prog_load prog_run };
+allow unconfined_domain_type domain:bpf { map_create map_read map_write prog_load prog_run };

 allow unconfined_domain_type self:lnk_file setattr;

Do you want this bz target RHEL 8.5?
Comment 2 Itamar Holder 2021-08-09 09:25:43 UTC 
The commit is the only commit within this PR: https://github.com/containers/container-selinux/pull/138
Meaning commit 4c51e97504d2f458eb3d14a776c9c859908b45b4: "Allow spc_t domains to set bpf rules on any domain".

Regarding RHEL version, maybe acardace or sgott can help answer?
Comment 3 sgott 2021-08-20 18:56:04 UTC 
Zdenek, it would be ideal if this could be backported to 8.4 actually.
Comment 4 Zdenek Pytela 2021-08-25 18:25:04 UTC 
(In reply to sgott from comment #3)
> Zdenek, it would be ideal if this could be backported to 8.4 actually.

I am afraid the current target will now be RHEL 8.6. If you need a z-stream backport to an earlier RHEL release, feel free to request it.
Comment 5 sgott 2021-08-27 16:39:33 UTC 
Thanks Zdenek, would this BZ be that request? I don't see that it has been assigned a target version yet.
Comment 28 errata-xmlrpc 2022-05-10 15:15:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:1995
Note You need to log in before you can comment on or make changes to this bug.