Bug 2295425 - bubblewrap sandbox not usable as a confined user
Summary: bubblewrap sandbox not usable as a confined user
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 40
Hardware: Unspecified
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-03 13:53 UTC by Sam Morris
Modified: 2024-11-05 04:42 UTC (History)
7 users (show)

Fixed In Version: selinux-policy-40.29-2.fc40
Clone Of:
Environment:
Last Closed: 2024-11-05 04:42:49 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2370 0 None open Allow staff user nlmsg_write 2024-10-02 11:23:41 UTC

Description Sam Morris 2024-07-03 13:53:29 UTC
When I'm running as the context staff_u:staff_r:staff_t:s0-s0:c0.c1023, the GNOME Image Viewer (loupe) doesn't work.

Opening an image displays the error message "Could not Load Image" "Loader process exited early with status '1'. "bwrap" "--unshare-all" "--clearenv" [... other args that I can't copy because the widget displaying the message doesn't let me select the text...]

Reproducible: Always

Steps to Reproduce:
1. Map user to staff_u
2. Log out and ensure no user processes remain
3. Log in and check context is staff_t
4. Download an image file
5. Open it with 'loupe'
Actual Results:  
loupe outputs the following:

bwrap: loopback: Failed RTM_NEWADDR: Permission denied
bwrap: loopback: Failed RTM_NEWADDR: Permission denied
bwrap: loopback: Failed RTM_NEWADDR: Permission denied
bwrap: loopback: Failed RTM_NEWADDR: Permission denied

These AVC denials are logged (after removing dontaudit rules):

type=AVC msg=audit(03/07/24 14:44:11.816:3069) : avc:  denied  { nlmsg_write } for  pid=543746 comm=bwrap scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=0 
----
type=AVC msg=audit(03/07/24 14:44:12.024:3070) : avc:  denied  { nlmsg_write } for  pid=543762 comm=bwrap scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=0 
----
type=AVC msg=audit(03/07/24 14:44:12.036:3071) : avc:  denied  { nlmsg_write } for  pid=543765 comm=bwrap scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=0 
----
type=AVC msg=audit(03/07/24 14:44:12.048:3072) : avc:  denied  { nlmsg_write } for  pid=543768 comm=bwrap scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=0 


If I run "bwrap ls" to I get "bwrap: Failed to make / slave: Permission denied" and this denial (not suppressed by dontaudit rules):

type=AVC msg=audit(1720014613.737:3121): avc:  denied  { mounton } for  pid=544752 comm="bwrap" path="/" dev="dm-1" ino=256 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=0

Comment 1 Fedora Update System 2024-10-26 12:02:12 UTC
FEDORA-2024-aa24e6024f (selinux-policy-40.29-1.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-aa24e6024f

Comment 2 Fedora Update System 2024-10-28 03:49:54 UTC
FEDORA-2024-a9588c99c1 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-a9588c99c1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-a9588c99c1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 3 Fedora Update System 2024-11-05 04:42:49 UTC
FEDORA-2024-a9588c99c1 (selinux-policy-40.29-2.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.