https://bugzilla.redhat.com/show_bug.cgi?id=1122434
Bug ID: 1122434
Summary: docker-io denied by selinux
Product: Fedora
Version: 19
Component: docker-io
Assignee: l...@fedoraproject.org
Reporter: d.bu...@saiweb.co.uk
QA Contact: extras...@fedoraproject.org
CC: admil...@redhat.com, golang@lists.fedoraproject.org,
hushan....@gmail.com, jper...@centos.org,
l...@fedoraproject.org, mat...@redhat.com,
mgold...@redhat.com, s...@shk.io, vba...@redhat.com
Description of problem:
A docker run will fail with permission denied
Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.12.1-74.26.fc19.noarch
docker-io-1.0.0-6.fc19.x86_6
How reproducible:
sudo docker run -t -i ubuntu /bin/bash
Steps to Reproduce:
1. sudo docker run -t -i ubuntu /bin/bash
2. 2014/07/23 08:55:21 permission denied
Actual results:
Permission denied
Expected results:
shell inside ubuntu container
Additional info:
***** Plugin catchall (100. confidence) suggests ***************************
If you believe that dockerinit-1.0.0 should be allowed transition access on
processes labeled svirt_lxc_net_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep dockerinit-1.0. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:initrc_t:s0
Target Context system_u:system_r:svirt_lxc_net_t:s0:c198,c908
Target Objects /bin/bash [ process ]
Source dockerinit-1.0.
Source Path /var/lib/docker/init/dockerinit-1.0.0
Port <Unknown>
Host icleus-oneiroi-co-uk
Source RPM Packages
Target RPM Packages bash-4.2.47-1.fc19.x86_64
Policy RPM selinux-policy-3.12.1-74.26.fc19.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name icleus-oneiroi-co-uk
Platform Linux icleus-oneiroi-co-uk 3.14.8-100.fc19.x86_64
#1 SMP Mon Jun 16 21:53:59 UTC 2014 x86_64 x86_64
Alert Count 1
First Seen 2014-07-23 09:55:21 BST
Last Seen 2014-07-23 09:55:21 BST
Local ID ebf8fa7f-3629-4814-880f-e88a3cbeae4d
Raw Audit Messages
type=AVC msg=audit(1406105721.713:546): avc: denied { transition } for
pid=24404 comm="dockerinit-1.0." path="/bin/bash" dev="dm-6" ino=525244
scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:system_r:svirt_lxc_net_t:s0:c198,c908 tclass=process
type=SYSCALL msg=audit(1406105721.713:546): arch=x86_64 syscall=execve
success=no exit=EACCES a0=c2100bbb70 a1=c2100bbb80 a2=c2100ba1e0 a3=0 items=0
ppid=20874 pid=24404 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts3 ses=4294967295 comm=dockerinit-1.0.
exe=/var/lib/docker/init/dockerinit-1.0.0 subj=system_u:system_r:initrc_t:s0
key=(null)
Hash: dockerinit-1.0.,initrc_t,svirt_lxc_net_t,process,transition
--
You are receiving this mail because:
You are on the CC list for the bug.
_______________________________________________
golang mailing list
golang@lists.fedoraproject.org
https://lists.fedoraproject.org/mailman/listinfo/golang
