[Bug 1109537] New: gear command line cannot be run with a confined user
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1109537
Bug ID: 1109537
Summary: gear command line cannot be run with a confined user
Product: Fedora
Version: 20
Component: geard
Assignee: lsm5(a)redhat.com
Reporter: misc(a)zarb.org
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
lsm5(a)redhat.com
Description of problem:
$ gear
zsh: permission denied: gear
$ id -Z
staff_u:staff_r:staff_t:s0-s0:c0.c1023
WIth setenforce 0, it work fine.
# rpm -q selinux-policy
selinux-policy-3.12.1-166.fc20.noarch
I am not sure if gear can be run as a simple user, but i would at least expect
to be able to see the command line options, since there is no manpage.
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 7 months
[Bug 1069718] New: Kernel container scalability issue in docker - VFS and mount path consuming too much CPU
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1069718
Bug ID: 1069718
Summary: Kernel container scalability issue in docker - VFS and
mount path consuming too much CPU
Product: Red Hat Enterprise Linux 7
Version: 7.0
Component: systemd
Severity: urgent
Priority: urgent
Assignee: systemd-maint(a)redhat.com
Reporter: sct(a)redhat.com
QA Contact: qe-baseos-daemons(a)redhat.com
CC: agk(a)redhat.com, alexl(a)redhat.com, fs-maint(a)redhat.com,
fweimer(a)redhat.com, golang(a)lists.fedoraproject.org,
ikent(a)redhat.com, jeder(a)redhat.com,
jpoimboe(a)redhat.com, lsm5(a)redhat.com,
lvm-team(a)redhat.com, mattdm(a)redhat.com,
mgoldman(a)redhat.com, mjenner(a)redhat.com,
perfbz(a)redhat.com, rwheeler(a)redhat.com,
skottler(a)redhat.com, vbatts(a)redhat.com
Depends On: 1061359, 1064929
Group: private
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1061359
[Bug 1061359] improve docker devicemapper backend scalability
https://bugzilla.redhat.com/show_bug.cgi?id=1064929
[Bug 1064929] Kernel container scalability issue in docker - VFS and mount
path consuming too much CPU
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 7 months
[Bug 1061359] New: improve docker devicemapper backend scalability
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1061359
Bug ID: 1061359
Summary: improve docker devicemapper backend scalability
Product: Fedora
Version: rawhide
Component: docker-io
Severity: high
Assignee: lsm5(a)redhat.com
Reporter: jeder(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: golang(a)lists.fedoraproject.org, lsm5(a)redhat.com,
mattdm(a)redhat.com, mgoldman(a)redhat.com,
skottler(a)redhat.com, vbatts(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 7 months
[Bug 1111233] New: RHEL6: docker run fails on --privileged
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1111233
Bug ID: 1111233
Summary: RHEL6: docker run fails on --privileged
Product: Fedora
Version: rawhide
Component: docker-io
Assignee: lsm5(a)redhat.com
Reporter: vbatts(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, lsm5(a)redhat.com,
mattdm(a)redhat.com, mgoldman(a)redhat.com, s(a)shk.io,
vbatts(a)redhat.com
Description of problem:
running a privileged container should not fail, but it does
Version-Release number of selected component (if applicable):
docker-io-1.0.0-3.el6.x86_64
How reproducible:
consistent
Steps to Reproduce:
1. docker run -it --rm --privileged fedora echo HOWDY
2.
3.
Actual results:
2014/06/19 09:58:45 Error: Cannot start container
807ea2ed77cdd98dd7dd5600aa363be6ae64c022a03dde70e033d5e7283808ab: stat
/dev/.udev/db/bsg:0:0:0:0: no such file or directory
Expected results:
HOWDY
Additional info:
This appears to already be resolved in docker/master branch.
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 7 months
[Bug 1119413] New: docker-io systemd unit file specifies environment file. But, does not uses it.
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1119413
Bug ID: 1119413
Summary: docker-io systemd unit file specifies environment
file. But, does not uses it.
Product: Fedora
Version: 20
Component: docker-io
Assignee: lsm5(a)switzerlandmail.ch
Reporter: prudhvi(a)mapr.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, lsm5(a)switzerlandmail.ch,
mattdm(a)redhat.com, mgoldman(a)redhat.com, s(a)shk.io,
vbatts(a)redhat.com
Description of problem:
docker-io package installs docker.service systemd unitfile that uses
EnvironemtFile (/etc/sysconfig/docker). But, does not uses it on ExecStart.
For our use case we run docker with special storage options to increase the
default rootfs size on the container to 30GB. To do that we have to specify
additional command line flags to the docker daemon (--storage-opt
dm.basesize=30G --storage-opt dm.loopdatasize=200G).
Having to edit ExecStart on every docker-io package update does not scale. This
bug requests the use of Environment flags defined in (/etc/sysconfig/docker) to
be used on the ExecStart command line.
How reproducible:
Always
Steps to Reproduce:
1. Install docker-io
2. Specify additional command line flags in environment file and start service
3. The service doesn't start with the given flags.
Actual results:
Service doesn't start with correct command line flags
Expected results:
Service starts with correct command line falgs.
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 8 months
[Bug 1119849] New: su - postgres Results in System Error inside Fedora 20/rawhide containers
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1119849
Bug ID: 1119849
Summary: su - postgres Results in System Error inside Fedora
20/rawhide containers
Product: Fedora
Version: 20
Component: docker-io
Assignee: lsm5(a)switzerlandmail.ch
Reporter: dgoodwin(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, lsm5(a)switzerlandmail.ch,
mattdm(a)redhat.com, mgoldman(a)redhat.com, s(a)shk.io,
vbatts(a)redhat.com
Description of problem:
Attempting to use postgresql in a docker container, errors occur due to an
issue with using su to the postgres user.
Looks similar to: https://bugzilla.redhat.com/show_bug.cgi?id=1098120#c15 but
the fix for libselinux should have been in Fedora images long ago.
Version-Release number of selected component (if applicable):
On host:
(root@lenovo ~) $ rpm -qa | grep docker
docker-registry-0.7.1-2.fc20.noarch
docker-io-1.0.0-6.fc20.x86_64
(root@lenovo ~) $ getenforce
Disabled
(root@lenovo ~) $ rpm -qa | grep libselinux
libselinux-python-2.2.1-6.fc20.x86_64
libselinux-utils-2.2.1-6.fc20.x86_64
libselinux-2.2.1-6.fc20.x86_64
libselinux-devel-2.2.1-6.fc20.x86_64
(root@lenovo ~) $
How reproducible: Very.
Steps to Reproduce:
Build the following Dockerfile on a fully updated Fedora 20 system:
FROM fedora:20
MAINTAINER Devan Goodwin <dgoodwin(a)redhat.com>
RUN yum -y update
RUN yum -y install postgresql postgresql-server
RUN su - postgres -c "ls /"
CMD ["/bin/bash"]
Actual results:
Complete!
---> 7b3287af76e9
Removing intermediate container d869af784195
Step 4 : RUN su - postgres -c "ls /"
---> Running in 72da359c2576
su: System error
2014/07/15 12:57:45 The command [/bin/sh -c su - postgres -c "ls /"] returned a
non-zero code: 1
Expected results:
The su error is blocking use of postgres in a number of ways starting with
initdb phase.
Additional info:
postgres user does exist at this point.
Problem also occurs if building off fedora:rawhide image.
Similar failures can be seen if you attempt to build the fedora-cloud
Postgresql container:
https://github.com/fedora-cloud/Fedora-Dockerfiles/tree/master/postgres I
believe these boil down to the same issue however.
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 8 months
[Bug 1122434] New: docker-io denied by selinux
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1122434
Bug ID: 1122434
Summary: docker-io denied by selinux
Product: Fedora
Version: 19
Component: docker-io
Assignee: lsm5(a)fedoraproject.org
Reporter: d.busby(a)saiweb.co.uk
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, jperrin(a)centos.org,
lsm5(a)fedoraproject.org, mattdm(a)redhat.com,
mgoldman(a)redhat.com, s(a)shk.io, vbatts(a)redhat.com
Description of problem:
A docker run will fail with permission denied
Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.12.1-74.26.fc19.noarch
docker-io-1.0.0-6.fc19.x86_6
How reproducible:
sudo docker run -t -i ubuntu /bin/bash
Steps to Reproduce:
1. sudo docker run -t -i ubuntu /bin/bash
2. 2014/07/23 08:55:21 permission denied
Actual results:
Permission denied
Expected results:
shell inside ubuntu container
Additional info:
***** Plugin catchall (100. confidence) suggests ***************************
If you believe that dockerinit-1.0.0 should be allowed transition access on
processes labeled svirt_lxc_net_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep dockerinit-1.0. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:initrc_t:s0
Target Context system_u:system_r:svirt_lxc_net_t:s0:c198,c908
Target Objects /bin/bash [ process ]
Source dockerinit-1.0.
Source Path /var/lib/docker/init/dockerinit-1.0.0
Port <Unknown>
Host icleus-oneiroi-co-uk
Source RPM Packages
Target RPM Packages bash-4.2.47-1.fc19.x86_64
Policy RPM selinux-policy-3.12.1-74.26.fc19.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name icleus-oneiroi-co-uk
Platform Linux icleus-oneiroi-co-uk 3.14.8-100.fc19.x86_64
#1 SMP Mon Jun 16 21:53:59 UTC 2014 x86_64 x86_64
Alert Count 1
First Seen 2014-07-23 09:55:21 BST
Last Seen 2014-07-23 09:55:21 BST
Local ID ebf8fa7f-3629-4814-880f-e88a3cbeae4d
Raw Audit Messages
type=AVC msg=audit(1406105721.713:546): avc: denied { transition } for
pid=24404 comm="dockerinit-1.0." path="/bin/bash" dev="dm-6" ino=525244
scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:system_r:svirt_lxc_net_t:s0:c198,c908 tclass=process
type=SYSCALL msg=audit(1406105721.713:546): arch=x86_64 syscall=execve
success=no exit=EACCES a0=c2100bbb70 a1=c2100bbb80 a2=c2100ba1e0 a3=0 items=0
ppid=20874 pid=24404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts3 ses=4294967295 comm=dockerinit-1.0.
exe=/var/lib/docker/init/dockerinit-1.0.0 subj=system_u:system_r:initrc_t:s0
key=(null)
Hash: dockerinit-1.0.,initrc_t,svirt_lxc_net_t,process,transition
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 8 months