Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-64730

Seliinux type container_engine_t is missing permissions to allow write to audit log

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 4.20.z
    • Node / CRI-O
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • x86_64
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

          Running sshd inside a container which is running with hostUsers: false and the container_engine_t selinux type.  Connections will fail because sshd is not allowed to write to the audit log.

      Version-Release number of selected component (if applicable):

          

      How reproducible:

          Always

      Steps to Reproduce:

      https://github.com/cgruver/devspaces-sshd-sandbox/blob/main/reproducer.md

      Actual results:

          

      Expected results:

          

      Additional info:

          The issue is resolved by adding the following to container_engine_t
      
      require {
      	type container_engine_t;
      	class netlink_audit_socket nlmsg_relay;
      }
      
      #============= container_engine_t ==============
      allow container_engine_t self:netlink_audit_socket nlmsg_relay;

              pehunt@redhat.com Peter Hunt
              cgruver@redhat.com Charro Gruver
              None
              None
              Min Li Min Li
              None
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: