Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-56109

containers-selinux failing when running scriptlet on Internal Tests

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Normal Normal
    • None
    • rhel-9.4.z
    • selinux-policy
    • None
    • No
    • None
    • rhel-sst-security-selinux
    • ssg_security
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None

      This has been seen in a couple of gating tests like:

      https://dashboard.osci.redhat.com/#/details/brew-build-63578912

      https://artifacts.osci.redhat.com/testing-farm/011648d7-fe71-4cb6-821d-850194ae4e81/work-installabilitytxep3b_v/installability/execute/data/guest/default-0/installability-2/data/viewer.html

      Running scriptlet: container-selinux-3:2.229.0-1.el9.noarch 19/23
      Could not set context for /var/lib/selinux/targeted/tmp/commit_num: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/file_contexts: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/file_contexts.homedirs: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/homedir_template: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules_checksum: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/policy.kern: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/seusers: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/users_extra: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/seusers.linked: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/users_extra.linked: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/policy.linked: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules/400/permissive_rhcd_t/lang_ext: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules/400/permissive_rhcd_t/cil: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules/400/permissive_rhcd_t: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules/400/restraint/lang_ext: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules/400/restraint/hll: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules/400/restraint/cil: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules/400/restraint: Permission denied
      Could not set context for /var/lib/selinux/targeted/tmp/modules/400/rhts/lang_ext: Permission denied

      ...

      We also see a bunch of AVC messages such as:


      type=PROCTITLE msg=audit(08/26/2024 04:16:13.956:1731) : proctitle=/usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1
      type=SYSCALL msg=audit(08/26/2024 04:16:13.956:1731) : arch=x86_64 syscall=lsetxattr success=no exit=EACCES(Permission denied) a0=0x5623b090a200 a1=0x7f40099a91c5 a2=0x5623b09d6820 a3=0x26 items=0 ppid=23150 pid=23151 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=7 comm=setsebool exe=/usr/sbin/setsebool subj=unconfined_u:unconfined_r:setsebool_t:s0-s0:c0.c1023 key=(null)
      type=AVC msg=audit(08/26/2024 04:16:13.956:1731) : avc: denied

      { relabelfrom } for pid=23151 comm=setsebool name=cil dev="xvda4" ino=729809067 scontext=unconfined_u:unconfined_r:setsebool_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:semanage_store_t:s0 tclass=file permissive=0
      ----
      type=PROCTITLE msg=audit(08/26/2024 04:16:13.956:1732) : proctitle=/usr/sbin/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1
      type=SYSCALL msg=audit(08/26/2024 04:16:13.956:1732) : arch=x86_64 syscall=lsetxattr success=no exit=EACCES(Permission denied) a0=0x5623b090a200 a1=0x7f40099a91c5 a2=0x5623b09d6820 a3=0x26 items=0 ppid=23150 pid=23151 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=7 comm=setsebool exe=/usr/sbin/setsebool subj=unconfined_u:unconfined_r:setsebool_t:s0-s0:c0.c1023 key=(null)
      type=AVC msg=audit(08/26/2024 04:16:13.956:1732) : avc: denied { relabelfrom }

      for pid=23151 comm=setsebool name=hll dev="xvda4" ino=729809068 scontext=unconfined_u:unconfined_r:setsebool_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:semanage_store_t:s0 tclass=file permissive=0


              rhn-support-zpytela Zdenek Pytela
              rhn-support-jmarrero Joseph Marrero Corchado
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

                Created:
                Updated:
                Resolved: