-
Bug
-
Resolution: Done
-
Undefined
-
None
-
rhel-9.2.0
-
None
-
Important
-
rhel-security-selinux
-
ssg_security
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
If docs needed, set a value
-
-
ppc64le
-
None
-
57,005
Description of problem:
selinux-policy seems to set selinuxuser_execmod=off by default on Power systems
This results in issues when running OpenShift with privileged pods.
sh-5.1# rpm -q container-selinux
container-selinux-2.219.0-1.rhaos4.13.el9.noarch
sh-5.1# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent -i | audit2allow
#============= spc_t ==============
#!!!! This avc can be allowed using the boolean 'selinuxuser_execmod'
allow spc_t container_ro_file_t:file execmod;
See https://bugzilla.redhat.com/show_bug.cgi?id=2230462 for the error in the package consumed by OpenShift.
Version-Release number of selected component (if applicable):
How reproducible:
We've been running openshift-tests on Power systems with the latest builds of RHCOS.
Steps to Reproduce:
1. Deploy openshift
2. Run openShift tests
3. Audit results for selinux denials
Actual results:
sh-5.1# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent -i | audit2allow
#============= spc_t ==============
#!!!! This avc can be allowed using the boolean 'selinuxuser_execmod'
allow spc_t container_ro_file_t:file execmod;
Expected results:
No errors
Additional info:
This seems only to be set off on Power. Other architectures are able to run privileged containers without issue.
- external trackers