Every time that you use ping in a rootless container using --network=pasta I get an AVC. Reproducible: Always Steps to Reproduce: 1. As a non-root user run: podman run --network=pasta -ti --rm fedora:latest bash -c "dnf install -y iputils && ping -c 5 8.8.8.8" Actual Results: We get this AVC: AVC avc: denied { name_bind } for pid=149601 comm="passt.avx2" src=6278 scontext=unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=icmp_socket permissive=0 However, the ping works. Expected Results: No AVC
Tested with: passt-0^20230509.g96f8d55-1.fc38.x86_64 passt-selinux-0^20230509.g96f8d55-1.fc38.noarch selinux-policy-38.12-1.fc38.noarch selinux-policy-targeted-38.12-1.fc38.noarch ● fedora:fedora/x86_64/coreos/stable Version: 38.20230430.3.1 (2023-05-15T21:32:02Z) BaseCommit: e7109bec01fdc47125e43fca01b9817d2371557a019bbcfc6a45527c93a23f98 GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464 LayeredPackages: borgbackup borgmatic btrbk passt python3 vim
Switching the component.
Fixed in https://github.com/containers/container-selinux/releases/tag/v2.217.0
FEDORA-2023-0e2449e909 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-0e2449e909
FEDORA-2023-a6bd0b248b has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2023-a6bd0b248b
FEDORA-2023-d41fad4b7b has been pushed to the Fedora 37 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-d41fad4b7b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d41fad4b7b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-f3847c4ae8 has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-f3847c4ae8` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-f3847c4ae8 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-f3847c4ae8 has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2023-d41fad4b7b has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report.