Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-128536

SELinux denial for listen() on SMC socket in unprivileged container

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • rhel-9.6, rhel-10.1
    • container-selinux
    • None
    • None
    • Moderate
    • rhel-container-tools
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      On OCP version 4.21 based on RHEL-10.1 stream when i ran an unprivileged pod and tried to run a server on SMC protocol, i see denials in audit log:

      sh-5.2$ strace -e socket smc_run socat TCP-LISTEN:5000 -
      — SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=95, si_uid=1000, si_status=1, si_utime=0, si_stime=0} —
      socket(AF_SMC, SOCK_STREAM, SMCPROTO_SMC) = 5
      2025/11/14 09:43:40 socat[94] E listen(5, 5): Permission denied

      time->Wed Nov 12 10:39:17 2025
      type=PROCTITLE msg=audit(1762943957.270:1625): proctitle=736F636174005443502D4C495354454E3A35303030002D
      type=SYSCALL msg=audit(1762943957.270:1625): arch=80000016 syscall=102 success=no exit=-13 a0=4 a1=3ffc7879a60 a2=3ff a3=3ffb27f5720 items=0 ppid=3130205 pid=3131757 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=4294967295 comm="socat" exe="/usr/bin/socat" subj=system_u:system_r:container_t:s0:c165,c452 key=(null)
      type=AVC msg=audit(1762943957.270:1625): avc:  denied  { listen } for  pid=3131757 comm="socat" scontext=system_u:system_r:container_t:s0:c165,c452 tcontext=system_u:system_r:container_t:s0:c165,c452 tclass=smc_socket permissive=0

      What is the impact of this issue to you?

      I can't run server programs and hence i can't use SMC sockets fully.

      Please provide the package NVR for which the bug is seen:

      How reproducible is this bug?:

      Everytime

      Steps to reproduce

      Mentioned above

      Expected results

      No permission denied

      Actual results

      Permission denied

              container-runtime-eng Container Runtime Eng Bot
              madeelrh Muhammad Adeel
              Dominik Werle, Lukas Vrabec, Sherine Khoury, Vikas Singh
              Container Runtime Eng Bot Container Runtime Eng Bot
              Container Runtime Bugs Bot Container Runtime Bugs Bot
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated: