Re: Does selinux work with kernel namespaces?

2018-02-11 Thread Matt Callaway
Thank you. > On Feb 11, 2018, at 4:46 AM, Daniel Walsh wrote: > > Docker and container runtimes on RHEL7.4 is not fully supported. We are > hoping to change that in RHEL7.5 > > There are lots of updates going into the kernel to allow usernamespace to > work properly. It should work with

Re: Does selinux work with kernel namespaces?

2018-02-11 Thread Daniel Walsh
Docker and container runtimes on RHEL7.4 is not fully supported.  We are hoping to change that in RHEL7.5 There are lots of updates going into the kernel to allow usernamespace to work properly.   It should work with SELinux at that time. On 02/09/2018 08:50 PM, Matt Callaway wrote: Then up

Re: Does selinux work with kernel namespaces?

2018-02-09 Thread Matt Callaway
Then updating to docker-ce again via the docker instructions: https://docs.docker.com/install/linux/docker-ce/centos/#set-up-the-repository Then I get: [root@localhost ~]# docker run hello-world docker: Error response from daemon: OCI runtime create failed: container_linux.go:296: starting conta

Re: Does selinux work with kernel namespaces?

2018-02-09 Thread Matt Callaway
I joined the selinux list and sent the above, but I have not seen it posted. I rebuilt my test system with stock centos 7.4 with the docker that it comes with and the kernel that it comes with. It runs fine before enabling userns-remap: [root@localhost ~]# uname -r 3.10.0-693.17.1.el7.x86_64 [roo

Re: Does selinux work with kernel namespaces?

2018-02-08 Thread Daniel Walsh
On 02/07/2018 04:10 PM, Matt Callaway wrote: Hello, I am attempting to run Docker on CentOS 7.4 with selinux and kernel namespaces enabled. When I do so I observe an error that leads me to an issue filed in github and a kernel patch that suggests that the cause should be fixed in kernel 4.11+. Y

Re: Does selinux work with kernel namespaces?

2018-02-08 Thread Stephen Smalley
On Wed, 2018-02-07 at 15:10 -0600, Matt Callaway wrote: > Hello, > > I am attempting to run Docker on CentOS 7.4 with selinux and kernel > namespaces enabled. When I do so I observe an error that leads me to > an issue filed in github and a kernel patch that suggests that the > cause should be fix