Closed space88man closed 4 years ago
@rhatdan PTAL
I can trigger this on fresh Fedora 31. CentOS 8 systemd root container, running rabbitmq-server.
From outside the container
podman exec rabbitmq_2 systemctl stop rabbitmq-server
See AVCs:
---
time->Tue Oct 29 18:49:36 2019
type=AVC msg=audit(1572346176.045:1478): avc: denied { getattr } for pid=240507 comm="ps" path="/proc/653" dev="proc" ino=5635971 scontext=system_u:system_r:container_t:s0:c28,c560 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
----
time->Tue Oct 29 18:49:37 2019
type=AVC msg=audit(1572346177.058:1479): avc: denied { getattr } for pid=240508 comm="ps" path="/proc/653" dev="proc" ino=5635971 scontext=system_u:system_r:container_t:s0:c28,c560 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
----
time->Tue Oct 29 18:49:38 2019
type=AVC msg=audit(1572346178.066:1480): avc: denied { getattr } for pid=240509 comm="ps" path="/proc/653" dev="proc" ino=5635971 scontext=system_u:system_r:container_t:s0:c28,c560 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
----
time->Tue Oct 29 18:49:39 2019
type=AVC msg=audit(1572346179.074:1482): avc: denied { getattr } for pid=240516 comm="ps" path="/proc/653" dev="proc" ino=5635971 scontext=system_u:system_r:container_t:s0:c28,c560 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
The command still works, though.
Reproducer on a fresh Fedora 31:
CON=$(buildah from centos:8)
buildah run $CON dnf install -y glibc-langpack-en
buildah run $CON dnf install -y https://github.com/rabbitmq/erlang-rpm/releases/download/v22.1.5/erlang-22.1.5-1.el8.x86_64.rpm
buildah run $CON dnf install -y https://github.com/rabbitmq/rabbitmq-server/releases/download/v3.7.20/rabbitmq-server-3.7.20-1.el8.noarch.rpm
buildah run $CON systemctl enable rabbitmq-server.service
buildah commit $CON rabbitmq:test
podman run -it --rm --name rabbit_1 --entrypoint /sbin/init rabbitmq:test
On the host run podman exec rabbit_1 systemctl stop rabbitmq-server
.
See
----
time->Tue Oct 29 19:11:07 2019
type=AVC msg=audit(1572347467.326:1909): avc: denied { getattr } for pid=247158 comm="ps" path="/proc/423" dev="proc" ino=5691516 scontext=system_u:system_r:container_t:s0:c519,c604 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
----
time->Tue Oct 29 19:11:08 2019
type=AVC msg=audit(1572347468.339:1910): avc: denied { getattr } for pid=247159 comm="ps" path="/proc/423" dev="proc" ino=5691516 scontext=system_u:system_r:container_t:s0:c519,c604 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
----
time->Tue Oct 29 19:11:09 2019
type=AVC msg=audit(1572347469.347:1911): avc: denied { getattr } for pid=247160 comm="ps" path="/proc/423" dev="proc" ino=5691516 scontext=system_u:system_r:container_t:s0:c519,c604 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
----
time->Tue Oct 29 19:11:10 2019
type=AVC msg=audit(1572347470.365:1913): avc: denied { getattr } for pid=247167 comm="ps" path="/proc/423" dev="proc" ino=5691516 scontext=system_u:system_r:container_t:s0:c519,c604 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
----
time->Tue Oct 29 19:11:11 2019
type=AVC msg=audit(1572347471.376:1914): avc: denied { getattr } for pid=247170 comm="ps" path="/proc/423" dev="proc" ino=5691516 scontext=system_u:system_r:container_t:s0:c519,c604 tcontext=unconfined_u:system_r:spc_t:s0 tclass=dir permissive=0
Do you know what process is running as spc_t?
ps -eZ | grep spc_t
@rhatdan it is the externally exec'ed program
# podman exec rabbit_1 ps -eZ
LABEL PID TTY TIME CMD
system_u:system_r:container_t:s0:c519,c604 1 ? 00:00:00 systemd
system_u:system_r:container_t:s0:c519,c604 16 ? 00:00:00 systemd-journal
system_u:system_r:container_t:s0:c519,c604 22 ? 00:00:00 dbus-daemon
system_u:system_r:container_t:s0:c519,c604 2286 ? 00:00:18 beam.smp
system_u:system_r:container_t:s0:c519,c604 2494 ? 00:00:00 epmd
system_u:system_r:container_t:s0:c519,c604 2644 ? 00:00:00 erl_child_setup
system_u:system_r:container_t:s0:c519,c604 2669 ? 00:00:00 inet_gethost
system_u:system_r:container_t:s0:c519,c604 2670 ? 00:00:00 inet_gethost
unconfined_u:system_r:spc_t:s0 10491 ? 00:00:00 ps
That is a bug.
PR has merged that should fix this.
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind bug
Description
After upgrading from Fedora 30 to Fedora 31, I am getting SELinux denials when container_t is trying to acess spc_t data. This doesn't prevent the container from functioning, though.
Any ideas where all this spc_t access is coming from?
Steps to reproduce the issue:
Upgrade from Fedora 30 to Fedora 31
Create a CentOS 8 container with /sbin/init as entrypoint
Do moderately complicated stuff like:
Describe the results you received: Lots of SELinux denials mesages when container_t tries to access spc_t data. Everything still works(!) and the container runs without any issues even when enforcing is on.
Describe the results you expected: Clean ausearch -m avc output.
Additional information you deem important (e.g. issue happens only occasionally): Need below to silence SELinux.
Output of
podman version
:Output of
podman info --debug
:Package info (e.g. output of
rpm -q podman
orapt list podman
):Additional environment details (AWS, VirtualBox, physical, etc.): Upgraded baremetal from F30 to F31. Sample AVC messages: