-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
4.20.z
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
None
-
None
-
x86_64
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
Running sshd inside a container which is running with hostUsers: false and the container_engine_t selinux type. Connections will fail because sshd is not allowed to write to the audit log.
Version-Release number of selected component (if applicable):
How reproducible:
Always
Steps to Reproduce:
https://github.com/cgruver/devspaces-sshd-sandbox/blob/main/reproducer.md
Actual results:
Expected results:
Additional info:
The issue is resolved by adding the following to container_engine_t
require {
type container_engine_t;
class netlink_audit_socket nlmsg_relay;
}
#============= container_engine_t ==============
allow container_engine_t self:netlink_audit_socket nlmsg_relay;
- is cloned by
-
RHEL-129122 [rhel 10.2] Selinux type container_engine_t is missing permissions to allow write to audit log
-
- Planning
-