-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
rhel-10.2
-
None
-
Important
-
rhel-container-tools
-
3
-
False
-
False
-
-
None
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
-
x86_64
-
None
Description of problem:
Running sshd inside a container which is running with hostUsers: false and the container_engine_t selinux type. Connections will fail because sshd is not allowed to write to the audit log.
Version-Release number of selected component (if applicable):
How reproducible:
Always
Steps to Reproduce:
https://github.com/cgruver/devspaces-sshd-sandbox/blob/main/reproducer.md
Actual results:
Expected results:
Additional info:
The issue is resolved by adding the following to container_engine_t
require {
type container_engine_t;
class netlink_audit_socket nlmsg_relay;
}
#============= container_engine_t ==============
allow container_engine_t self:netlink_audit_socket nlmsg_relay;
- clones
-
OCPBUGS-64730 Seliinux type container_engine_t is missing permissions to allow write to audit log
-
- POST
-