[Bug 1169769] New: Docker attempts to create /.docker/key.json, AVC denial logged
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1169769
Bug ID: 1169769
Summary: Docker attempts to create /.docker/key.json, AVC
denial logged
Product: Fedora
Version: 21
Component: docker-io
Assignee: lsm5(a)redhat.com
Reporter: jpazdziora(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, jchaloup(a)redhat.com,
jperrin(a)centos.org, lsm5(a)redhat.com,
mattdm(a)redhat.com, mgoldman(a)redhat.com,
miminar(a)redhat.com, s(a)shk.io, thrcka(a)redhat.com,
vbatts(a)redhat.com
Description of problem:
The docker daemon while started with
service docker start
creates (in permissive) file /.docker/key.json which causes AVC denials
type=AVC msg=audit(1417516329.990:76): avc: denied { add_name } for
pid=17382 comm="docker" name=".docker" scontext=system_u:system_r:docker_t:s0
tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1417516329.990:77): avc: denied { create } for pid=17382
comm="docker" name=".docker" scontext=system_u:system_r:docker_t:s0
tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1417516330.009:78): avc: denied { create } for pid=17382
comm="docker" name="key.json" scontext=system_u:system_r:docker_t:s0
tcontext=system_u:object_r:root_t:s0 tclass=file permissive=1
type=AVC msg=audit(1417516330.009:79): avc: denied { write open } for
pid=17382 comm="docker" path="/.docker/key.json" dev="dm-1" ino=1966082
scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:root_t:s0
tclass=file permissive=1
The content of the file is
# cat /.docker/key.json
{
"crv": "P-256",
"d": "P26swnaqdOlv1BTVxFX4sovmfazqGCTbwpDobXOn68I",
"kid": "5MPO:WGMK:B2WZ:YAUE:7WC3:6YGV:VVHO:7A2H:IPHA:RRV7:CN5Q:ZW3W",
"kty": "EC",
"x": "_FkP8EvVH6dia4iVBYmmy5c43tHkzxWC4f1QD7TlE_A",
"y": "X2BQ1cXpAucYcBN3FmY8T2gFXR10pLmqJRQFKGfY2zY"
}
Version-Release number of selected component (if applicable):
docker-io-1.3.2-3.git353ff40.fc21.x86_64
selinux-policy-3.13.1-92.fc21.noarch
How reproducible:
Seen once, assume deterministic.
Steps to Reproduce:
1. Install docker-io.
2. Start the service.
3. Check /var/log/audit/audit.log.
Actual results:
AVC denial and in permissive, root directory polluted with /.docker/key.json.
Expected results:
No AVC denial, docker keeps its files to itself.
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 4 months
[golang-github-ghodss-yaml/el6] Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5 - related: #1172603
by Jan Chaloupka
commit b57b58d80383b8f0ac665c4b9eb93f1674c4a758
Author: Jan Chaloupka <jchaloup(a)redhat.com>
Date: Wed Dec 24 13:53:10 2014 +0100
Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
- related: #1172603
.gitignore | 2 +-
golang-github-ghodss-yaml.spec | 8 ++++++--
sources | 2 +-
3 files changed, 8 insertions(+), 4 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index f8d938a..bca60e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-/yaml-92ff9d3.tar.gz
+/yaml-4fb5c72.tar.gz
diff --git a/golang-github-ghodss-yaml.spec b/golang-github-ghodss-yaml.spec
index 72e833b..c2b66b8 100644
--- a/golang-github-ghodss-yaml.spec
+++ b/golang-github-ghodss-yaml.spec
@@ -4,12 +4,12 @@
%global project ghodss
%global repo yaml
%global import_path %{provider}.%{provider_tld}/%{project}/%{repo}
-%global commit 92ff9d30bd0a5a2d077f3bc00843e409f65cd38e
+%global commit 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Name: golang-%{provider}-%{project}-%{repo}
Version: 0
-Release: 0.1.git%{shortcommit}%{?dist}
+Release: 0.2.git%{shortcommit}%{?dist}
Summary: A better way to marshal and unmarshal YAML in Golang
License: MIT
URL: https://%{import_path}
@@ -55,6 +55,10 @@ GOPATH=%{buildroot}/%{gopath}:%{gopath} go test %{import_path}
%{gopath}/src/%{import_path}
%changelog
+* Wed Dec 24 2014 jchaloup <jchaloup(a)redhat.com> - 0-0.2.git92ff9d3
+- Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
+ related: #1172603
+
* Tue Dec 09 2014 jchaloup <jchaloup(a)redhat.com> - 0-0.1.git92ff9d3
- First package for Fedora
resolves: #1172603
diff --git a/sources b/sources
index 575faf8..62d1a9d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-498922473fee402d9a50da6c63a655cd yaml-92ff9d3.tar.gz
+15595a63ff58a0065af46d0b1c265faa yaml-4fb5c72.tar.gz
9 years, 4 months
[golang-github-ghodss-yaml] Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5 - related: #1172603
by Jan Chaloupka
commit 1b3bf77132165236df3c0877bcbb03f9794693e3
Author: Jan Chaloupka <jchaloup(a)redhat.com>
Date: Wed Dec 24 13:53:10 2014 +0100
Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
- related: #1172603
.gitignore | 2 +-
golang-github-ghodss-yaml.spec | 8 ++++++--
sources | 2 +-
3 files changed, 8 insertions(+), 4 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index f8d938a..bca60e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-/yaml-92ff9d3.tar.gz
+/yaml-4fb5c72.tar.gz
diff --git a/golang-github-ghodss-yaml.spec b/golang-github-ghodss-yaml.spec
index 72e833b..c2b66b8 100644
--- a/golang-github-ghodss-yaml.spec
+++ b/golang-github-ghodss-yaml.spec
@@ -4,12 +4,12 @@
%global project ghodss
%global repo yaml
%global import_path %{provider}.%{provider_tld}/%{project}/%{repo}
-%global commit 92ff9d30bd0a5a2d077f3bc00843e409f65cd38e
+%global commit 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Name: golang-%{provider}-%{project}-%{repo}
Version: 0
-Release: 0.1.git%{shortcommit}%{?dist}
+Release: 0.2.git%{shortcommit}%{?dist}
Summary: A better way to marshal and unmarshal YAML in Golang
License: MIT
URL: https://%{import_path}
@@ -55,6 +55,10 @@ GOPATH=%{buildroot}/%{gopath}:%{gopath} go test %{import_path}
%{gopath}/src/%{import_path}
%changelog
+* Wed Dec 24 2014 jchaloup <jchaloup(a)redhat.com> - 0-0.2.git92ff9d3
+- Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
+ related: #1172603
+
* Tue Dec 09 2014 jchaloup <jchaloup(a)redhat.com> - 0-0.1.git92ff9d3
- First package for Fedora
resolves: #1172603
diff --git a/sources b/sources
index 575faf8..62d1a9d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-498922473fee402d9a50da6c63a655cd yaml-92ff9d3.tar.gz
+15595a63ff58a0065af46d0b1c265faa yaml-4fb5c72.tar.gz
9 years, 4 months
[golang-github-ghodss-yaml/f21] Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5 - related: #1172603
by Jan Chaloupka
commit bb55245ceea502801422fb9aea5da31cff4bca3c
Author: Jan Chaloupka <jchaloup(a)redhat.com>
Date: Wed Dec 24 13:53:10 2014 +0100
Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
- related: #1172603
.gitignore | 2 +-
golang-github-ghodss-yaml.spec | 8 ++++++--
sources | 2 +-
3 files changed, 8 insertions(+), 4 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index f8d938a..bca60e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-/yaml-92ff9d3.tar.gz
+/yaml-4fb5c72.tar.gz
diff --git a/golang-github-ghodss-yaml.spec b/golang-github-ghodss-yaml.spec
index 72e833b..c2b66b8 100644
--- a/golang-github-ghodss-yaml.spec
+++ b/golang-github-ghodss-yaml.spec
@@ -4,12 +4,12 @@
%global project ghodss
%global repo yaml
%global import_path %{provider}.%{provider_tld}/%{project}/%{repo}
-%global commit 92ff9d30bd0a5a2d077f3bc00843e409f65cd38e
+%global commit 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Name: golang-%{provider}-%{project}-%{repo}
Version: 0
-Release: 0.1.git%{shortcommit}%{?dist}
+Release: 0.2.git%{shortcommit}%{?dist}
Summary: A better way to marshal and unmarshal YAML in Golang
License: MIT
URL: https://%{import_path}
@@ -55,6 +55,10 @@ GOPATH=%{buildroot}/%{gopath}:%{gopath} go test %{import_path}
%{gopath}/src/%{import_path}
%changelog
+* Wed Dec 24 2014 jchaloup <jchaloup(a)redhat.com> - 0-0.2.git92ff9d3
+- Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
+ related: #1172603
+
* Tue Dec 09 2014 jchaloup <jchaloup(a)redhat.com> - 0-0.1.git92ff9d3
- First package for Fedora
resolves: #1172603
diff --git a/sources b/sources
index 575faf8..62d1a9d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-498922473fee402d9a50da6c63a655cd yaml-92ff9d3.tar.gz
+15595a63ff58a0065af46d0b1c265faa yaml-4fb5c72.tar.gz
9 years, 4 months
[golang-github-ghodss-yaml/f20] Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5 - related: #1172603
by Jan Chaloupka
commit 8e5bcad03d5f1c0e07ac5d2fb65f13de18dbb596
Author: Jan Chaloupka <jchaloup(a)redhat.com>
Date: Wed Dec 24 13:53:10 2014 +0100
Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
- related: #1172603
.gitignore | 2 +-
golang-github-ghodss-yaml.spec | 8 ++++++--
sources | 2 +-
3 files changed, 8 insertions(+), 4 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index f8d938a..bca60e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-/yaml-92ff9d3.tar.gz
+/yaml-4fb5c72.tar.gz
diff --git a/golang-github-ghodss-yaml.spec b/golang-github-ghodss-yaml.spec
index 72e833b..c2b66b8 100644
--- a/golang-github-ghodss-yaml.spec
+++ b/golang-github-ghodss-yaml.spec
@@ -4,12 +4,12 @@
%global project ghodss
%global repo yaml
%global import_path %{provider}.%{provider_tld}/%{project}/%{repo}
-%global commit 92ff9d30bd0a5a2d077f3bc00843e409f65cd38e
+%global commit 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
%global shortcommit %(c=%{commit}; echo ${c:0:7})
Name: golang-%{provider}-%{project}-%{repo}
Version: 0
-Release: 0.1.git%{shortcommit}%{?dist}
+Release: 0.2.git%{shortcommit}%{?dist}
Summary: A better way to marshal and unmarshal YAML in Golang
License: MIT
URL: https://%{import_path}
@@ -55,6 +55,10 @@ GOPATH=%{buildroot}/%{gopath}:%{gopath} go test %{import_path}
%{gopath}/src/%{import_path}
%changelog
+* Wed Dec 24 2014 jchaloup <jchaloup(a)redhat.com> - 0-0.2.git92ff9d3
+- Bump to 4fb5c728a37b361a1e971a3bb3d785fcc96b6ef5
+ related: #1172603
+
* Tue Dec 09 2014 jchaloup <jchaloup(a)redhat.com> - 0-0.1.git92ff9d3
- First package for Fedora
resolves: #1172603
diff --git a/sources b/sources
index 575faf8..62d1a9d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-498922473fee402d9a50da6c63a655cd yaml-92ff9d3.tar.gz
+15595a63ff58a0065af46d0b1c265faa yaml-4fb5c72.tar.gz
9 years, 4 months