Loading...

Type: Bug
Resolution: Unresolved
Priority: Critical
Fix Version/s: None
Affects Version/s: rhel-9.6.z
Component/s: container-selinux
Labels:
- regression

Regression:
None
Severity:
Moderate

AssignedTeam:
rhel-container-tools

Story Points:
3
Blocked:
False
Ready:
False
Blocked Reason:

Hide

None

Show
None
Product Documentation Required:
None
Sprint:
None

Preliminary Testing:
Requested
Test Coverage:
None

ProdDocsReview-CCS:
Unspecified
ProdDocsReview-Dev:
Unspecified
ProdDocsReview-QE:
Unspecified

Experience:

PX Impact Score:
SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

Planning:
None

This is a clone ~~RHEL-123749~~ for RHEL9.6.z.

I re-tested the latest 9.6.0.z build (container-selinux-2.237.0-2.el9_6), and it indeed has the same issue, since it already includes PR405.

The original bug is as below:

What were you trying to do that didn't work?

I'm testing podman APIv2 feature for rhel9.7 0day. I hit this issue when running apiv2 tests. After "setenforce 0", this issue will be not seen.

Please provide the package NVR for which the bug is seen:

podman-5.6.0-5.el9_7.x86_64
container-selinux-2.240.0-2.el9_7.noarch

How reproducible is this bug?

always

Steps to reproduce

PODMAN=/usr/bin/podman PODMAN_SERVICE_PORT=8085 ./test-apiv2 20
============================= test session starts ==============================
podman client -- curl 7.76.1 (x86_64-redhat-linux-gnu) libcurl/7.76.1 OpenSSL/3.5.1 zlib/1.2.11 brotli/1.0.9 libidn2/2.3.0 libpsl/0.21.1 (+libidn2/2.3.0) libssh/0.10.4/openssl/zlib nghttp2/1.43.0
Release-Date: 2021-04-14
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: alt-svc AsynchDNS brotli GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets
collected 1 items

# started service, pid 64007
ok 1 [20-containers] GET libpod/containers/json (at start: clean slate) : status=200
ok 2 [20-containers] GET libpod/containers/json (at start: clean slate) : output=[]
ok 3 [20-containers] GET libpod/containers/json (at start: clean slate) : length=0
ok 4 [20-containers] header does not contain application/json ('HTTP/1.1 200 OK^M') ~ .*Content-Type: application/json.*
ok 5 [20-containers] POST containers/foo/attach?logs=true&stream=false [-d {}] : status=200
not ok 6 [20-containers] POST containers/foo/attach?logs=true&stream=false [-d {}] : output
#  expected: hi-there-uTSqTT157iaZrv0
#    actual: YError relocating /lib/ld-musl-x86_64.so.1: RELRO protection failed: No error information
HError relocating /bin/sh: RELRO protection failed: No error information
ok 7 [20-containers] vnd.docker.raw-stream docker v1.40 ('HTTP/1.1 200 OK^M') ~ .*Content-Type: application/vnd\.docker\.raw-stream.*
not ok 8 [20-containers] POST /v1.42/containers/foo/attach?logs=true&stream=false [-d {}] : status
#  expected: 200
#    actual: 500
#  response: {"cause":"no such container","message":"no container with ID ac7e061fe18891aa6d9039a21e0a8333c299c31a0bcd3ba85431d254ecad624d found in database: no such container","response":500}
not ok 9 [20-containers] vnd.docker.multiplexed-stream docker v1.42
#  expected: ~ .*Content-Type: application/vnd\.docker\.multiplexed-stream.*
#    actual: HTTP/1.1 500 Internal Server Error
Api-Version: 1.41
Content-Type: application/json
Libpod-Api-Version: 5.6.0
Server: Libpod/5.6.0 (linux)
X-Reference-Id: 0xc00007a448
Date: Fri, 24 Oct 2025 03:06:42 GMT
Content-Length: 180

not ok 10 [20-containers] POST /v4.6.0/libpod/containers/foo/attach?logs=true&stream=false [-d {}] : status
#  expected: 200
#    actual: 404
#  response: {"cause":"no such container","message":"no container with name or ID \"foo\" found: no such container","response":404}
not ok 11 [20-containers] vnd.docker.raw-stream libpod v4.6.0
#  expected: ~ .*Content-Type: application/vnd\.docker\.raw-stream.*
#    actual: HTTP/1.1 404 Not Found
Api-Version: 1.41
Content-Type: application/json
Libpod-Api-Version: 5.6.0
Server: Libpod/5.6.0 (linux)
X-Reference-Id: 0xc0008980d8
Date: Fri, 24 Oct 2025 03:06:42 GMT
Content-Length: 119

not ok 12 [20-containers] POST /v4.7.0/libpod/containers/foo/attach?logs=true&stream=false [-d {}] : status
#  expected: 200
#    actual: 404
#  response: {"cause":"no such container","message":"no container with name or ID \"foo\" found: no such container","response":404}
not ok 13 [20-containers] vnd.docker.multiplexed-stream libpod v4.7.0
#  expected: ~ .*Content-Type: application/vnd\.docker\.multiplexed-stream.*
#    actual: HTTP/1.1 404 Not Found
Api-Version: 1.41
Content-Type: application/json
Libpod-Api-Version: 5.6.0
Server: Libpod/5.6.0 (linux)
X-Reference-Id: 0xc00007a498
Date: Fri, 24 Oct 2025 03:06:42 GMT
Content-Length: 119

not ok 14 [20-containers] POST containers/foo/attach?logs=true&stream=false [-d {}] : status
#  expected: 101
#    actual: 404
#  response: {"cause":"no such container","message":"no container with name or ID \"foo\" found: no such container","response":404}
not ok 15 [20-containers] hijacked connection header: Content-type: application/vnd.docker.raw-stream
#  expected: ~ .*Content-Type: application/vnd\.docker\.raw-stream.*
#    actual: HTTP/1.1 404 Not Found
Api-Version: 1.41
Content-Type: application/json
Libpod-Api-Version: 5.6.0
Server: Libpod/5.6.0 (linux)
X-Reference-Id: 0xc00007a4b0
Date: Fri, 24 Oct 2025 03:06:42 GMT
Content-Length: 119

not ok 16 [20-containers] hijacked connection header: Upgrade: tcp
#  expected: ~ .*Upgrade: tcp.*
#    actual: HTTP/1.1 404 Not Found
Api-Version: 1.41
Content-Type: application/json
Libpod-Api-Version: 5.6.0
Server: Libpod/5.6.0 (linux)
X-Reference-Id: 0xc00007a4b0
Date: Fri, 24 Oct 2025 03:06:42 GMT
Content-Length: 119

not ok 17 [20-containers] POST containers/foo/kill [-d {}] : status
#  expected: 204
#    actual: 404
not ok 18 [20-containers] POST containers/foo/kill [-d {}]: 204 status returns no output
#  expected: ''
#    actual: {"cause":"no such container","message":"no container with name or ID \"foo\" found: no such container","response":404}
Fatal error in /root/rpmbuild/SOURCES/containers-podman-c5a3735/test/apiv2/20-containers.at:53
Log:
  >$ /usr/bin/podman pull quay.io/libpod/testimage:20241011
  >Trying to pull quay.io/libpod/testimage:20241011...
  >Getting image source signatures
  >Copying blob sha256:33b517cffde0ecb1f424f107b005cdfd614c467b9de2ad334970f800b77a4e70
  >Copying blob sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
  >Copying config sha256:b82e560ed57b77a897379e160371adcf1b000ca885e69c62cbec674777a83850
  >Writing manifest to image destination
  >b82e560ed57b77a897379e160371adcf1b000ca885e69c62cbec674777a83850
  >$ /usr/bin/podman tag quay.io/libpod/testimage:20241011 localhost/test/testformultitag:tag
  >$ /usr/bin/podman rm -a -f
  >$ /usr/bin/podman run --rm -d --replace --name foo quay.io/libpod/testimage:20241011 sh -c echo hi-there-uTSqTT157iaZrv0;sleep 42
  >ac7e061fe18891aa6d9039a21e0a8333c299c31a0bcd3ba85431d254ecad624d
  >$ /usr/bin/podman run --replace --name=foo -v /tmp:/tmp quay.io/libpod/testimage:20241011 true
  >Error relocating /lib/ld-musl-x86_64.so.1: RELRO protection failed: No error information
  >Error relocating /bin/true: RELRO protection failed: No error information
Bailing.
# stopped service, pid 64007
test-apiv2: curl failure (7) on http://localhost:8085/v1.41/containers/foo/kill - cannot continue. args=-d {}

Expected results

The test cases should pass.

Actual results

The AVCs:

ausearch -m avc
----
time->Thu Oct 23 23:04:42 2025
type=PROCTITLE msg=audit(1761275082.858:1647): proctitle=2F62696E2F7368002D63003E66696C6531
type=SYSCALL msg=audit(1761275082.858:1647): arch=c000003e syscall=10 success=no exit=-13 a0=7fa3a959a000 a1=1000 a2=1 a3=7fa3a951d761 items=0 ppid=61007 pid=61016 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="sh" exe="/bin/busybox" subj=system_u:system_r:container_t:s0:c646,c953 key=(null)
type=AVC msg=audit(1761275082.858:1647): avc:  denied  { read } for  pid=61016 comm="sh" path="/lib/ld-musl-x86_64.so.1" dev="dm-0" ino=1046125 scontext=system_u:system_r:container_t:s0:c646,c953 tcontext=unconfined_u:object_r:container_var_run_t:s0 tclass=file permissive=0
----
time->Thu Oct 23 23:04:42 2025
type=PROCTITLE msg=audit(1761275082.859:1648): proctitle=2F62696E2F7368002D63003E66696C6531
type=SYSCALL msg=audit(1761275082.859:1648): arch=c000003e syscall=10 success=no exit=-13 a0=5619f75c3000 a1=4000 a2=1 a3=5619f74fe380 items=0 ppid=61007 pid=61016 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="sh" exe="/bin/busybox" subj=system_u:system_r:container_t:s0:c646,c953 key=(null)
type=AVC msg=audit(1761275082.859:1648): avc:  denied  { read } for  pid=61016 comm="sh" path="/bin/busybox" dev="dm-0" ino=50878073 scontext=system_u:system_r:container_t:s0:c646,c953 tcontext=unconfined_u:object_r:container_var_run_t:s0 tclass=file permissive=0
----

clones

RHEL-123749 Error relocating /lib/ld-musl-x86_64.so.1: RELRO protection failed: No error information

Closed

Details

Description

What were you trying to do that didn't work?

Please provide the package NVR for which the bug is seen:

How reproducible is this bug?

Steps to reproduce

Expected results

Actual results

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates