#57 plugins: Add containers plugin
Closed by rfilo. Opened by rfilo.
rfilo/setroubleshoot containers  into  main

Download 57.patch

It tries to find an issue related to spc_t and container_t domains where target class is dir or file.

rebased onto 8edc417559e0a0ced056be393abe15266284eb84

There is still one problem with fix button there. If you click on button the AVCs are appeared. It probably has a problem with semanage fcontext.

Why it's split to 2 lines?

Do you plan to add other classes supported by udica policies?

If you use podman you can use :z or :Z suffix for volume mounts, see podman-run(1):

   Labeling Volume Mounts
   Labeling  systems  like  SELinux  require that proper labels are placed on volume content mounted into a con‐
   tainer. Without a label, the security system might prevent the processes running inside  the  container  from
   using the content. By default, Podman does not change the labels set by the OS.
   To  change a label in the container context, you can add either of two suffixes :z or :Z to the volume mount.
   These suffixes tell Podman to relabel file objects on the shared volumes. The z option tells Podman that  two
   containers  share  the  volume  content.  As a result, Podman labels the content with a shared content label.
   Shared volume labels allow all containers to read/write content.  The Z option tells Podman to label the con‐
   tent with a private unshared label.

It would be great to have some real world examples or references either in commit message or directly as part of comment in the plugin. Also I'd interested why semanage fcontext is the suggested as a solution .

Here I've got a fix command and after click it should be executed. After I click on the button I can see pop-up window with message "usage:semanage [-h]"and AVCs:
time->Tue Mar 23 17:55:27 2021
type=AVC msg=audit(1616518527.775:12425): avc: denied { execute } for pid=2431194 comm="sealert" name="semanage" dev="dm-1" ino=4083504 scontext=system_u:system_r:setroubleshoot_fixit_t:s0 tcontext=system_u:object_r:semanage_exec_t:s0 tclass=file permissive=1


time->Tue Mar 23 17:55:27 2021
type=AVC msg=audit(1616518527.775:12426): avc: denied { read open } for pid=2431194 comm="sealert" path="/usr/sbin/semanage" dev="dm-1" ino=4083504 scontext=system_u:system_r:setroubleshoot_fixit_t:s0 tcontext=system_u:object_r:semanage_exec_t:s0 tclass=file permissive=1


time->Tue Mar 23 17:55:27 2021
type=AVC msg=audit(1616518527.775:12427): avc: denied { execute_no_trans } for pid=2431194 comm="sealert" path="/usr/sbin/semanage" dev="dm-1" ino=4083504 scontext=system_u:system_r:setroubleshoot_fixit_t:s0 tcontext=system_u:object_r:semanage_exec_t:s0 tclass=file permissive=1


time->Tue Mar 23 17:55:27 2021
type=AVC msg=audit(1616518527.789:12428): avc: denied { ioctl } for pid=2431194 comm="semanage" path="/usr/sbin/semanage" dev="dm-1" ino=4083504 ioctlcmd=0x5451 scontext=system_u:system_r:setroubleshoot_fixit_t:s0 tcontext=system_u:object_r:semanage_exec_t:s0 tclass=file permissive=1

Pull-Request has been closed by rfilo

Metadata