Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-129122

[rhel 10.2] Selinux type container_engine_t is missing permissions to allow write to audit log

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • None
    • Important
    • rhel-container-tools
    • 3
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • x86_64
    • None

      Description of problem:

          Running sshd inside a container which is running with hostUsers: false and the container_engine_t selinux type.  Connections will fail because sshd is not allowed to write to the audit log.

      Version-Release number of selected component (if applicable):

          

      How reproducible:

          Always

      Steps to Reproduce:

      https://github.com/cgruver/devspaces-sshd-sandbox/blob/main/reproducer.md

      Actual results:

          

      Expected results:

          

      Additional info:

          The issue is resolved by adding the following to container_engine_t
      
      require {
      	type container_engine_t;
      	class netlink_audit_socket nlmsg_relay;
      }
      
      #============= container_engine_t ==============
      allow container_engine_t self:netlink_audit_socket nlmsg_relay;

              lmandvek Lokesh Mandvekar
              cgruver@redhat.com Charro Gruver
              Container Runtime Eng Bot Container Runtime Eng Bot
              Container Runtime Bugs Bot Container Runtime Bugs Bot
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: