https://bugzilla.redhat.com/show_bug.cgi?id=1335523
Bug ID: 1335523 Summary: Docker run fails with "ApplyLayer exit status 1 stdout: stderr: invalid argument" and SELINUX alert is raised Product: Fedora Version: 23 Component: docker-distribution Assignee: lsm5@redhat.com Reporter: tmlcoch@redhat.com QA Contact: extras-qa@fedoraproject.org CC: admiller@redhat.com, golang@lists.fedoraproject.org, jchaloup@redhat.com, lsm5@redhat.com, marianne@tuxette.fr, ttomecek@redhat.com
Description of problem:
When I try to use docker, it always fails with weird error and selinux alert:
The alert:
kvě 12 14:04:48 blackbox setroubleshoot[3720]: SELinux is preventing exe from mac_admin access on the capability2 Unknown. For complete SELinux messages. run sealert -l b8af2d9b-e0ca-45a6-89aa-1dd13f840c67
kvě 12 14:04:48 blackbox python3[3720]: SELinux is preventing exe from mac_admin access on the capability2 Unknown.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that exe should be allowed mac_admin access on the Unknown capability2 by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c exe --raw | audit2allow -M mypol # semodule -i mypol.pp
Reproducer:
$ sudo systemctl start docker $ sudo docker run -ti registry.access.redhat.com/rhel6.7 bash Unable to find image 'registry.access.redhat.com/rhel6.7:latest' locally 0701b067a296: Error pulling image (latest) from registry.access.redhat.com/rhel6.7, ApplyLayer exit status 1 stdout: stderr: invalid argument failed Error pulling image (latest) from registry.access.redhat.com/rhel6.7, ApplyLayer exit status 1 stdout: stderr: invalid argument
Version-Release number of selected component (if applicable):
$ uname -a Linux blackbox 4.4.8-300.fc23.x86_64 #1 SMP Wed Apr 20 16:59:27 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -q docker docker-selinux libselinux selinux-policy selinux-policy-targeted docker-1.9.1-9.gitee06d03.fc23.x86_64 docker-selinux-1.9.1-9.gitee06d03.fc23.x86_64 libselinux-2.4-4.fc23.x86_64 libselinux-2.4-4.fc23.i686 selinux-policy-3.13.1-158.14.fc23.noarch selinux-policy-targeted-3.13.1-158.14.fc23.noarch
How reproducible: Always
https://bugzilla.redhat.com/show_bug.cgi?id=1335523
--- Comment #1 from Tomas Mlcoch tmlcoch@redhat.com --- Just a note, the solution suggested by selinux troubleshooter:
ausearch -c exe --raw | audit2allow -M mypol semodule -i mypol.pp
worked and now I'm able to use docker correctly.
https://bugzilla.redhat.com/show_bug.cgi?id=1335523
Tomas Tomecek ttomecek@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |adimania@gmail.com, | |amurdaca@redhat.com, | |dwalsh@redhat.com, | |ichavero@redhat.com, | |jcajka@redhat.com, | |miminar@redhat.com, | |nalin@redhat.com, | |riek@llunved.net, | |vbatts@redhat.com Component|docker-distribution |docker
--- Comment #2 from Tomas Tomecek ttomecek@redhat.com --- I think this should reported against "docker", not "docker-distribution".
When you disable selinux, are you able to pull images?
https://bugzilla.redhat.com/show_bug.cgi?id=1335523
--- Comment #3 from Tomas Mlcoch tmlcoch@redhat.com --- As I wrote in comment #1 in the end, I was able to pull images even when selinux enabled, but I had to use the commands from selinux troubleshooter.
https://bugzilla.redhat.com/show_bug.cgi?id=1335523
--- Comment #4 from Daniel Walsh dwalsh@redhat.com --- What was the AVC that you were seeing?
ausearch -m avc
https://bugzilla.redhat.com/show_bug.cgi?id=1335523
--- Comment #5 from Tomas Mlcoch tmlcoch@redhat.com --- time->Thu May 12 14:04:44 2016 type=AVC msg=audit(1463054684.400:380): avc: denied { mac_admin } for pid=3679 comm="exe" capability=33 scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:docker_t:s0 tclass=capability2 permissive=0
https://bugzilla.redhat.com/show_bug.cgi?id=1335523
--- Comment #6 from Daniel Walsh dwalsh@redhat.com --- This means that docker attempted to write a label that the kernel did not understand. This is not something you want to use. Looks like their is something wrong with your selinux-policy install.
dnf -y reinstall selinux-policy* docker-selinux
And see if this fixes the issue.
https://bugzilla.redhat.com/show_bug.cgi?id=1335523
--- Comment #7 from Tomas Mlcoch tmlcoch@redhat.com --- I've reinstalled selinux-policy packages: $ dnf -y reinstall selinux-policy* docker-selinux
Removed the mypol package that fixed the issue before: $ sudo semodule -r mypol
Restarted docker service: $ sudo systemctl restart docker
And tried again: $ sudo docker run -ti registry.access.redhat.com/rhel6.7 bash
I'm not sure if the revert of: ausearch -c exe --raw | audit2allow -M mypol semodule -i mypol.pp was done correctly, but if so, then feel free to close this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1335523
Daniel Walsh dwalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG Last Closed| |2016-05-14 06:12:57
golang@lists.fedoraproject.org