[Bug 1122434] New: docker-io denied by selinux
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1122434
Bug ID: 1122434
Summary: docker-io denied by selinux
Product: Fedora
Version: 19
Component: docker-io
Assignee: lsm5(a)fedoraproject.org
Reporter: d.busby(a)saiweb.co.uk
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, jperrin(a)centos.org,
lsm5(a)fedoraproject.org, mattdm(a)redhat.com,
mgoldman(a)redhat.com, s(a)shk.io, vbatts(a)redhat.com
Description of problem:
A docker run will fail with permission denied
Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.12.1-74.26.fc19.noarch
docker-io-1.0.0-6.fc19.x86_6
How reproducible:
sudo docker run -t -i ubuntu /bin/bash
Steps to Reproduce:
1. sudo docker run -t -i ubuntu /bin/bash
2. 2014/07/23 08:55:21 permission denied
Actual results:
Permission denied
Expected results:
shell inside ubuntu container
Additional info:
***** Plugin catchall (100. confidence) suggests ***************************
If you believe that dockerinit-1.0.0 should be allowed transition access on
processes labeled svirt_lxc_net_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep dockerinit-1.0. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:initrc_t:s0
Target Context system_u:system_r:svirt_lxc_net_t:s0:c198,c908
Target Objects /bin/bash [ process ]
Source dockerinit-1.0.
Source Path /var/lib/docker/init/dockerinit-1.0.0
Port <Unknown>
Host icleus-oneiroi-co-uk
Source RPM Packages
Target RPM Packages bash-4.2.47-1.fc19.x86_64
Policy RPM selinux-policy-3.12.1-74.26.fc19.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name icleus-oneiroi-co-uk
Platform Linux icleus-oneiroi-co-uk 3.14.8-100.fc19.x86_64
#1 SMP Mon Jun 16 21:53:59 UTC 2014 x86_64 x86_64
Alert Count 1
First Seen 2014-07-23 09:55:21 BST
Last Seen 2014-07-23 09:55:21 BST
Local ID ebf8fa7f-3629-4814-880f-e88a3cbeae4d
Raw Audit Messages
type=AVC msg=audit(1406105721.713:546): avc: denied { transition } for
pid=24404 comm="dockerinit-1.0." path="/bin/bash" dev="dm-6" ino=525244
scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:system_r:svirt_lxc_net_t:s0:c198,c908 tclass=process
type=SYSCALL msg=audit(1406105721.713:546): arch=x86_64 syscall=execve
success=no exit=EACCES a0=c2100bbb70 a1=c2100bbb80 a2=c2100ba1e0 a3=0 items=0
ppid=20874 pid=24404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts3 ses=4294967295 comm=dockerinit-1.0.
exe=/var/lib/docker/init/dockerinit-1.0.0 subj=system_u:system_r:initrc_t:s0
key=(null)
Hash: dockerinit-1.0.,initrc_t,svirt_lxc_net_t,process,transition
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 9 months
[golang-github-smarterclayton-go-systemd/el6: 2/2] obsoleted by golang-github-openshift-go-systemd
by Lokesh Mandvekar
commit 2190011d5d5100ffa189e9bd274f4204a4942f0c
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Aug 21 20:55:07 2014 -0500
obsoleted by golang-github-openshift-go-systemd
.gitignore | 1 -
dead.package | 1 +
golang-github-smarterclayton-go-systemd.spec | 75 --------------------------
sources | 1 -
4 files changed, 1 insertions(+), 77 deletions(-)
---
diff --git a/dead.package b/dead.package
new file mode 100644
index 0000000..941ba3a
--- /dev/null
+++ b/dead.package
@@ -0,0 +1 @@
+obsoleted by golang-github-openshift-go-systemd
9 years, 9 months
[golang-github-smarterclayton-go-systemd/epel7] obsoleted by golang-github-openshift-go-systemd
by Lokesh Mandvekar
commit 306d7bedbc730c2ded702bf998e037f6ddbd2952
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Aug 21 20:52:42 2014 -0500
obsoleted by golang-github-openshift-go-systemd
.gitignore | 1 -
dead.package | 1 +
golang-github-smarterclayton-go-systemd.spec | 72 --------------------------
sources | 1 -
4 files changed, 1 insertions(+), 74 deletions(-)
---
diff --git a/dead.package b/dead.package
new file mode 100644
index 0000000..941ba3a
--- /dev/null
+++ b/dead.package
@@ -0,0 +1 @@
+obsoleted by golang-github-openshift-go-systemd
9 years, 9 months
[golang-github-smarterclayton-go-systemd/f19] obsoleted by golang-github-openshift-go-systemd
by Lokesh Mandvekar
commit fba02e1afe98db1b8d86a7009812f577da63f499
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Aug 21 20:52:12 2014 -0500
obsoleted by golang-github-openshift-go-systemd
.gitignore | 1 -
dead.package | 1 +
golang-github-smarterclayton-go-systemd.spec | 72 --------------------------
sources | 1 -
4 files changed, 1 insertions(+), 74 deletions(-)
---
diff --git a/dead.package b/dead.package
new file mode 100644
index 0000000..941ba3a
--- /dev/null
+++ b/dead.package
@@ -0,0 +1 @@
+obsoleted by golang-github-openshift-go-systemd
9 years, 9 months
[golang-github-smarterclayton-go-systemd/f20] obsoleted by golang-github-openshift-go-systemd
by Lokesh Mandvekar
commit 9cecac4207354fce19eb32ddb866e829c564ffa6
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Aug 21 20:44:03 2014 -0500
obsoleted by golang-github-openshift-go-systemd
.gitignore | 1 -
dead.package | 1 +
golang-github-smarterclayton-go-systemd.spec | 72 --------------------------
sources | 1 -
4 files changed, 1 insertions(+), 74 deletions(-)
---
diff --git a/dead.package b/dead.package
new file mode 100644
index 0000000..941ba3a
--- /dev/null
+++ b/dead.package
@@ -0,0 +1 @@
+obsoleted by golang-github-openshift-go-systemd
9 years, 9 months
[golang-github-smarterclayton-go-systemd/f21] obsoleted by golang-github-openshift-go-systemd
by Lokesh Mandvekar
commit ee8fbbdecde3b6bc57ab042ed27c9ec0c6b973c9
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Aug 21 20:43:37 2014 -0500
obsoleted by golang-github-openshift-go-systemd
.gitignore | 1 -
dead.package | 1 +
golang-github-smarterclayton-go-systemd.spec | 75 --------------------------
sources | 1 -
4 files changed, 1 insertions(+), 77 deletions(-)
---
diff --git a/dead.package b/dead.package
new file mode 100644
index 0000000..941ba3a
--- /dev/null
+++ b/dead.package
@@ -0,0 +1 @@
+obsoleted by golang-github-openshift-go-systemd
9 years, 9 months