https://bugzilla.redhat.com/show_bug.cgi?id=1169769
Bug ID: 1169769
Summary: Docker attempts to create /.docker/key.json, AVC
denial logged
Product: Fedora
Version: 21
Component: docker-io
Assignee: lsm5(a)redhat.com
Reporter: jpazdziora(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, jchaloup(a)redhat.com,
jperrin(a)centos.org, lsm5(a)redhat.com,
mattdm(a)redhat.com, mgoldman(a)redhat.com,
miminar(a)redhat.com, s(a)shk.io, thrcka(a)redhat.com,
vbatts(a)redhat.com
Description of problem:
The docker daemon while started with
service docker start
creates (in permissive) file /.docker/key.json which causes AVC denials
type=AVC msg=audit(1417516329.990:76): avc: denied { add_name } for
pid=17382 comm="docker" name=".docker"
scontext=system_u:system_r:docker_t:s0
tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1417516329.990:77): avc: denied { create } for pid=17382
comm="docker" name=".docker" scontext=system_u:system_r:docker_t:s0
tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1417516330.009:78): avc: denied { create } for pid=17382
comm="docker" name="key.json" scontext=system_u:system_r:docker_t:s0
tcontext=system_u:object_r:root_t:s0 tclass=file permissive=1
type=AVC msg=audit(1417516330.009:79): avc: denied { write open } for
pid=17382 comm="docker" path="/.docker/key.json" dev="dm-1"
ino=1966082
scontext=system_u:system_r:docker_t:s0 tcontext=system_u:object_r:root_t:s0
tclass=file permissive=1
The content of the file is
# cat /.docker/key.json
{
"crv": "P-256",
"d": "P26swnaqdOlv1BTVxFX4sovmfazqGCTbwpDobXOn68I",
"kid":
"5MPO:WGMK:B2WZ:YAUE:7WC3:6YGV:VVHO:7A2H:IPHA:RRV7:CN5Q:ZW3W",
"kty": "EC",
"x": "_FkP8EvVH6dia4iVBYmmy5c43tHkzxWC4f1QD7TlE_A",
"y": "X2BQ1cXpAucYcBN3FmY8T2gFXR10pLmqJRQFKGfY2zY"
}
Version-Release number of selected component (if applicable):
docker-io-1.3.2-3.git353ff40.fc21.x86_64
selinux-policy-3.13.1-92.fc21.noarch
How reproducible:
Seen once, assume deterministic.
Steps to Reproduce:
1. Install docker-io.
2. Start the service.
3. Check /var/log/audit/audit.log.
Actual results:
AVC denial and in permissive, root directory polluted with /.docker/key.json.
Expected results:
No AVC denial, docker keeps its files to itself.
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.