2:30 a.m.
Hi,
I have a problem mapping a cifs network share to a container.
It's an auto-mount and from the /etc/auto.mnt I can see it's mounted with:
-fstype=cifs,rw,noperm,vers=3.0
The mount is attached to the /mnt/share-name
I run image of the container with:
sudo podman run --pod pod-name --detach --name container-name -v
/mnt/share-name:/usr/src/app/share:rw,z .........
I get:
Error: failed to set file label on /mnt/share-name: operation not supported
Wonder if anybody could help me and point me to the right direction.
Thanks
9:17 a.m.
Rem,
My guess would be CIFS doesn't support SELinux, so when it tries to
label the mount point it fails. Try and run without SELinux enabled. Try
--privileged as a quick and dirty, but I believe there is a --security-opt=
label to just disable SELinux.
Best Regards
Scott M
On Thu, Apr 1, 2021 at 3:32 AM <rem(a)llgc.org.uk> wrote:
Hi,
I have a problem mapping a cifs network share to a container.
It's an auto-mount and from the /etc/auto.mnt I can see it's mounted with:
-fstype=cifs,rw,noperm,vers=3.0
The mount is attached to the /mnt/share-name
I run image of the container with:
sudo podman run --pod pod-name --detach --name container-name -v
/mnt/share-name:/usr/src/app/share:rw,z .........
I get:
Error: failed to set file label on /mnt/share-name: operation not supported
Wonder if anybody could help me and point me to the right direction.
Thanks
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
--
--
18 ways to differentiate open source products from upstream suppliers:
https://opensource.com/article/21/2/differentiating-products-upstream-sup...
--
Scott McCarty
Product Management - Containers, Red Hat Enterprise Linux & OpenShift
Email: smccarty(a)redhat.com
Phone: 312-660-3535
Cell: 330-807-1043
Web: http://crunchtools.com
10:44 a.m.
Hi Scott,
Thanks for the hint.
I've tried with --priviliged and it kind of went ahead, but stopped at a single file
that resides on the share with "Error: failed to set file label on file_location_here
operation not supported"
So maybe I will manage to get it to work with the sysadmins.
Best regards
Remi
8:44 p.m.
On 4/1/21 11:44, rem(a)llgc.org.uk wrote:
Hi Scott,
Thanks for the hint.
I've tried with --priviliged and it kind of went ahead, but stopped at a single file
that resides on the share with "Error: failed to set file label on file_location_here
operation not supported"
So maybe I will manage to get it to work with the sysadmins.
Best regards
Remi
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
Remove the ,z flag on the volume mount, this should work without the
--privileged flag.
2:25 a.m.
Thanks for the hint Daniel. It does work, but not without --privileged option.
Without the option I get access denied from the container.
With the parameter I can read and write and it's all visible outside of the
container.
Thanks
Remi
7:33 a.m.
On 4/6/21 03:25, Remi Malessa wrote:
Thanks for the hint Daniel. It does work, but not without
--privileged option.
Without the option I get access denied from the container.
With the parameter I can read and write and it's all visible outside of the
container.
Thanks
Remi
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
What AVCs are you seeing?
12:42 p.m.
Daniel,
Nothing actually pop-up in the audit.log when I get :
ls: cannot open directory '.': Permission denied
...inside the container.
It's funny, because I can navigate the directories on the remote share (although I
can't list them. I can even see content of text files.
2:27 p.m.
On 4/6/21 13:42, Remi Malessa wrote:
Daniel,
Nothing actually pop-up in the audit.log when I get :
ls: cannot open directory '.': Permission denied
...inside the container.
It's funny, because I can navigate the directories on the remote share (although I
can't list them. I can even see content of text files.
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
Can you do
`semodule -DB` on the host
Then try to access the directory
Gather the AVCs about container_t.
Then
`semodule -B` on the host to turn off dontaudit rules.
3:57 a.m.
Thanks for your time Daniel, here's what appear in the audit when I run "ls"
:
type=AVC msg=audit(1617801763.586:47751): avc: denied { read } for pid=280379
comm="ls" name="Validation" dev="cifs" ino=281474976710700
scontext=system_u:system_r:container_t:s0:c100,c420 tcontext=system_u:object_r:cifs_t:s0
tclass=dir permissive=0
type=SYSCALL msg=audit(1617801763.586:47751): arch=c000003e syscall=257 success=no
exit=-13 a0=ffffff9c a1=555e8b326210 a2=90800 a3=0 items=0 ppid=280171 pid=280379
auid=724607387 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1058
comm="ls" exe="/bin/ls"
subj=system_u:system_r:container_t:s0:c100,c420 key=(null)ARCH=x86_64 SYSCALL=openat
AUID="rem" UID="root" GID="root" EUID="root"
SUID="root" FSUID="root" EGID="root" SGID="root"
FSGID="root"
type=PROCTITLE msg=audit(1617801763.586:47751): proctitle=6C73002D6C
type=AVC msg=audit(1617801766.605:47752): avc: denied { net_admin } for pid=280381
comm="dbus-daemon-lau" capability=12
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0
type=SYSCALL msg=audit(1617801766.605:47752): arch=c000003e syscall=54 success=no exit=-1
a0=5 a1=1 a2=21 a3=7ffdff2d9a50 items=0 ppid=280380 pid=280381 auid=4294967295 uid=81
gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295
comm="dbus-daemon-lau"
exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus"
EUID="root" SUID="root" FSUID="root" EGID="dbus"
SGID="dbus" FSGID="dbus"
type=PROCTITLE msg=audit(1617801766.605:47752):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464
type=AVC msg=audit(1617801766.605:47753): avc: denied { net_admin } for pid=280381
comm="dbus-daemon-lau" capability=12
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0
type=SYSCALL msg=audit(1617801766.605:47753): arch=c000003e syscall=54 success=no exit=-1
a0=5 a1=1 a2=20 a3=7ffdff2d9a50 items=0 ppid=280380 pid=280381 auid=4294967295 uid=81
gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295
comm="dbus-daemon-lau"
exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus"
EUID="root" SUID="root" FSUID="root" EGID="dbus"
SGID="dbus" FSGID="dbus"
type=PROCTITLE msg=audit(1617801766.605:47753):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464
type=AVC msg=audit(1617801766.608:47754): avc: denied { noatsecure } for pid=280381
comm="dbus-daemon-lau" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0
type=AVC msg=audit(1617801766.608:47754): avc: denied { rlimitinh } for pid=280381
comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0
type=AVC msg=audit(1617801766.608:47754): avc: denied { siginh } for pid=280381
comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0
type=SYSCALL msg=audit(1617801766.608:47754): arch=c000003e syscall=59 success=yes exit=0
a0=5592801eaad0 a1=5592801eaa20 a2=5592801e88f0 a3=0 items=2 ppid=280380 pid=280381
auid=4294967295 uid=990 gid=987 euid=990 suid=990 fsuid=990 egid=987 sgid=987 fsgid=987
tty=(none) ses=4294967295 comm="setroubleshootd"
exe="/usr/libexec/platform-python3.6"
subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=execve AUID="unset" UID="setroubleshoot"
GID="setroubleshoot" EUID="setroubleshoot"
SUID="setroubleshoot" FSUID="setroubleshoot"
EGID="setroubleshoot" SGID="setroubleshoot"
FSGID="setroubleshoot"
type=EXECVE msg=audit(1617801766.608:47754): argc=5
a0="/usr/libexec/platform-python" a1="-Es"
a2="/usr/sbin/setroubleshootd" a3="-f" a4=""
type=CWD msg=audit(1617801766.608:47754): cwd="/"
type=PATH msg=audit(1617801766.608:47754): item=0
name="/usr/libexec/platform-python" inode=269287 dev=fd:00 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1617801766.608:47754): item=1
name="/lib64/ld-linux-x86-64.so.2" inode=25347812 dev=fd:00 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1617801766.608:47754):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464
type=AVC msg=audit(1617801768.907:47755): avc: denied { net_admin } for pid=280394
comm="dbus-daemon-lau" capability=12
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0
type=SYSCALL msg=audit(1617801768.907:47755): arch=c000003e syscall=54 success=no exit=-1
a0=6 a1=1 a2=21 a3=7ffec59c2f80 items=0 ppid=280393 pid=280394 auid=4294967295 uid=81
gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295
comm="dbus-daemon-lau"
exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus"
EUID="root" SUID="root" FSUID="root" EGID="dbus"
SGID="dbus" FSGID="dbus"
type=PROCTITLE msg=audit(1617801768.907:47755):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7450726976696C65676564
type=AVC msg=audit(1617801768.907:47756): avc: denied { net_admin } for pid=280394
comm="dbus-daemon-lau" capability=12
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0
type=SYSCALL msg=audit(1617801768.907:47756): arch=c000003e syscall=54 success=no exit=-1
a0=6 a1=1 a2=20 a3=7ffec59c2f80 items=0 ppid=280393 pid=280394 auid=4294967295 uid=81
gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295
comm="dbus-daemon-lau"
exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus"
EUID="root" SUID="root" FSUID="root" EGID="dbus"
SGID="dbus" FSGID="dbus"
type=PROCTITLE msg=audit(1617801768.907:47756):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7450726976696C65676564
type=AVC msg=audit(1617801768.910:47757): avc: denied { noatsecure } for pid=280394
comm="dbus-daemon-lau" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process
permissive=0
type=AVC msg=audit(1617801768.910:47757): avc: denied { rlimitinh } for pid=280394
comm="SetroubleshootP" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process
permissive=0
type=AVC msg=audit(1617801768.910:47757): avc: denied { siginh } for pid=280394
comm="SetroubleshootP" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process
permissive=0
type=SYSCALL msg=audit(1617801768.910:47757): arch=c000003e syscall=59 success=yes exit=0
a0=5613f94d0c40 a1=5613f94d2370 a2=5613f94ce8f0 a3=1 items=2 ppid=280393 pid=280394
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=4294967295 comm="SetroubleshootP"
exe="/usr/libexec/platform-python3.6"
subj=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=execve AUID="unset" UID="root" GID="root"
EUID="root" SUID="root" FSUID="root" EGID="root"
SGID="root" FSGID="root"
type=EXECVE msg=audit(1617801768.910:47757): argc=2
a0="/usr/libexec/platform-python"
a1="/usr/share/setroubleshoot/SetroubleshootPrivileged.py"
type=CWD msg=audit(1617801768.910:47757): cwd="/"
type=PATH msg=audit(1617801768.910:47757): item=0
name="/usr/libexec/platform-python" inode=269287 dev=fd:00 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1617801768.910:47757): item=1
name="/lib64/ld-linux-x86-64.so.2" inode=25347812 dev=fd:00 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1617801768.910:47757):
2:15 a.m.
Daniel, my sysadmin has fixed the problem with SELinux. Thank you very much for the
hints.
Kind regards
Remi
8:03 a.m.
Remi,
I'm curious, do you know what was going on or how they fixed it? Would
be good for all of us to know for when the next person asks :-)
Best Regards
Scott M
On Fri, Apr 9, 2021 at 3:16 AM Remi Malessa <rem(a)llgc.org.uk> wrote:
Daniel, my sysadmin has fixed the problem with SELinux. Thank you
very
much for the hints.
Kind regards
Remi
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
--
--
18 ways to differentiate open source products from upstream suppliers:
https://opensource.com/article/21/2/differentiating-products-upstream-sup...
--
Scott McCarty
Product Management - Containers, Red Hat Enterprise Linux & OpenShift
Email: smccarty(a)redhat.com
Phone: 312-660-3535
Cell: 330-807-1043
Web: http://crunchtools.com
1:09 p.m.
Hi Scott,I tried to reproduce the error reported by Remi.I fixed it by adding the option
context="system_u:object_r:container_file_t:s0" to the mount command.
You can find more details at
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/...
.
I wait Remi's answer too ;)
Kind regards,Alessandro Bernardi
Il venerdì 9 aprile 2021, 15:07:53 CEST, Scott McCarty <smccarty(a)redhat.com> ha
scritto:
Remi, I'm curious, do you know what was going on or how they fixed it? Would be
good for all of us to know for when the next person asks :-)
Best RegardsScott M
On Fri, Apr 9, 2021 at 3:16 AM Remi Malessa <rem(a)llgc.org.uk> wrote:
Daniel, my sysadmin has fixed the problem with SELinux. Thank you very much for the
hints.
Kind regards
Remi
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
--
--18 ways to differentiate open source products from upstream suppliers:
https://opensource.com/article/21/2/differentiating-products-upstream-sup...
--
Scott McCarty
Product Management - Containers, Red Hat Enterprise Linux & OpenShift
Email: smccarty(a)redhat.com
Phone: 312-660-3535
Cell: 330-807-1043
Web: http://crunchtools.com_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
2:19 p.m.
On 4/9/21 09:03, Scott McCarty wrote:
Remi,
I'm curious, do you know what was going on or how they fixed it?
Would be good for all of us to know for when the next person asks :-)
I took the AVCs reported and ran them through audit2allow.
```
audit2allow -i /tmp/t
#============= container_t ==============
#!!!! This avc can be allowed using the boolean 'virt_use_samba'
allow container_t cifs_t:dir read;
...
```
But I would prefer you to think I am a real genius. :^)
Best Regards
Scott M
On Fri, Apr 9, 2021 at 3:16 AM Remi Malessa <rem(a)llgc.org.uk
<mailto:rem@llgc.org.uk>> wrote:
Daniel, my sysadmin has fixed the problem with SELinux. Thank you
very much for the hints.
Kind regards
Remi
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
<mailto:podman@lists.podman.io>
To unsubscribe send an email to podman-leave(a)lists.podman.io
<mailto:podman-leave@lists.podman.io>
--
--
18 ways to differentiate open source products from upstream
suppliers:https://opensource.com/article/21/2/differentiating-products-up...
<https://opensource.com/article/21/2/differentiating-products-upstream-sup...
--
Scott McCarty Product Management - Containers, Red Hat Enterprise
Linux & OpenShift Email: smccarty(a)redhat.com
<mailto:smccarty@redhat.com> Phone: 312-660-3535 Cell: 330-807-1043
Web: http://crunchtools.com <http://crunchtools.com>
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
6:06 a.m.
Scott,
I asked the sysadmin, but he does not know / don't remember the exact rules that
fixed.
We will be moving to a production server at some point, then we will be dealing with
(likely) exactly the same problem. He said he may try to answer the question then.
I will update the thread when this happen.
Sorry
Remi
6:12 a.m.
Sounds good! Thanks for checking.
On Tue, Apr 13, 2021, 7:08 AM Remi Malessa <rem(a)llgc.org.uk> wrote:
Scott,
I asked the sysadmin, but he does not know / don't remember the exact
rules that fixed.
We will be moving to a production server at some point, then we will be
dealing with (likely) exactly the same problem. He said he may try to
answer the question then.
I will update the thread when this happen.
Sorry
Remi
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
6:16 a.m.
This is what he said:
"(..)so I used the tool and flags “audit2allow -a -w” this showed me the issues that
were denying based on the SELinux baseline for the box. From here you can follow the
recommendations (the setbool command I mentioned) and also you can use “audit2allow -a -M
somepolicy” to create a policy to install (you do this using semodule -i somepolicy.pp)
In our case I could apply this as there were only those rules to apply, but you would
probably want to be more granular on most systems for example:
grep yourService /var/log/audit/audit.log | audit2allow -M anotherPolicy &&
semodule –i anotherPolicy.pp(...)"
7:45 a.m.
On 4/13/21 07:16, Remi Malessa wrote:
This is what he said:
"(..)so I used the tool and flags “audit2allow -a -w” this showed me the issues that
were denying based on the SELinux baseline for the box. From here you can follow the
recommendations (the setbool command I mentioned) and also you can use “audit2allow -a -M
somepolicy” to create a policy to install (you do this using semodule -i somepolicy.pp)
In our case I could apply this as there were only those rules to apply, but you would
probably want to be more granular on most systems for example:
grep yourService /var/log/audit/audit.log | audit2allow -M anotherPolicy &&
semodule –i anotherPolicy.pp(...)"
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
I would just turn on the boolean. If you see more AVCs about
container_t then you should report them as issues on container-selinux.
5:19 a.m.
Hi, the admin used this: ```setsebool -P virt_use_samba 1```
Also , there were some problems on the file permissions for the remote directories.
Hope this helps, thanks.
Remi
9:18 a.m.
On 4/8/21 04:57, Remi Malessa wrote:
Thanks for your time Daniel, here's what appear in the audit when
I run "ls" :
type=AVC msg=audit(1617801763.586:47751): avc: denied { read } for pid=280379
comm="ls" name="Validation" dev="cifs" ino=281474976710700
scontext=system_u:system_r:container_t:s0:c100,c420 tcontext=system_u:object_r:cifs_t:s0
tclass=dir permissive=0
type=SYSCALL msg=audit(1617801763.586:47751): arch=c000003e syscall=257 success=no
exit=-13 a0=ffffff9c a1=555e8b326210 a2=90800 a3=0 items=0 ppid=280171 pid=280379
auid=724607387 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1058
comm="ls" exe="/bin/ls"
subj=system_u:system_r:container_t:s0:c100,c420 key=(null)ARCH=x86_64 SYSCALL=openat
AUID="rem" UID="root" GID="root" EUID="root"
SUID="root" FSUID="root" EGID="root" SGID="root"
FSGID="root"
type=PROCTITLE msg=audit(1617801763.586:47751): proctitle=6C73002D6C
type=AVC msg=audit(1617801766.605:47752): avc: denied { net_admin } for pid=280381
comm="dbus-daemon-lau" capability=12
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0
type=SYSCALL msg=audit(1617801766.605:47752): arch=c000003e syscall=54 success=no exit=-1
a0=5 a1=1 a2=21 a3=7ffdff2d9a50 items=0 ppid=280380 pid=280381 auid=4294967295 uid=81
gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295
comm="dbus-daemon-lau"
exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus"
EUID="root" SUID="root" FSUID="root" EGID="dbus"
SGID="dbus" FSGID="dbus"
type=PROCTITLE msg=audit(1617801766.605:47752):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464
type=AVC msg=audit(1617801766.605:47753): avc: denied { net_admin } for pid=280381
comm="dbus-daemon-lau" capability=12
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0
type=SYSCALL msg=audit(1617801766.605:47753): arch=c000003e syscall=54 success=no exit=-1
a0=5 a1=1 a2=20 a3=7ffdff2d9a50 items=0 ppid=280380 pid=280381 auid=4294967295 uid=81
gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295
comm="dbus-daemon-lau"
exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus"
EUID="root" SUID="root" FSUID="root" EGID="dbus"
SGID="dbus" FSGID="dbus"
type=PROCTITLE msg=audit(1617801766.605:47753):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464
type=AVC msg=audit(1617801766.608:47754): avc: denied { noatsecure } for pid=280381
comm="dbus-daemon-lau" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0
type=AVC msg=audit(1617801766.608:47754): avc: denied { rlimitinh } for pid=280381
comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0
type=AVC msg=audit(1617801766.608:47754): avc: denied { siginh } for pid=280381
comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0
type=SYSCALL msg=audit(1617801766.608:47754): arch=c000003e syscall=59 success=yes exit=0
a0=5592801eaad0 a1=5592801eaa20 a2=5592801e88f0 a3=0 items=2 ppid=280380 pid=280381
auid=4294967295 uid=990 gid=987 euid=990 suid=990 fsuid=990 egid=987 sgid=987 fsgid=987
tty=(none) ses=4294967295 comm="setroubleshootd"
exe="/usr/libexec/platform-python3.6"
subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=execve AUID="unset" UID="setroubleshoot"
GID="setroubleshoot" EUID="setroubleshoot"
SUID="setroubleshoot" FSUID="setroubleshoot"
EGID="setroubleshoot" SGID="setroubleshoot"
FSGID="setroubleshoot"
type=EXECVE msg=audit(1617801766.608:47754): argc=5
a0="/usr/libexec/platform-python" a1="-Es"
a2="/usr/sbin/setroubleshootd" a3="-f" a4=""
type=CWD msg=audit(1617801766.608:47754): cwd="/"
type=PATH msg=audit(1617801766.608:47754): item=0
name="/usr/libexec/platform-python" inode=269287 dev=fd:00 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1617801766.608:47754): item=1
name="/lib64/ld-linux-x86-64.so.2" inode=25347812 dev=fd:00 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1617801766.608:47754):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464
type=AVC msg=audit(1617801768.907:47755): avc: denied { net_admin } for pid=280394
comm="dbus-daemon-lau" capability=12
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0
type=SYSCALL msg=audit(1617801768.907:47755): arch=c000003e syscall=54 success=no exit=-1
a0=6 a1=1 a2=21 a3=7ffec59c2f80 items=0 ppid=280393 pid=280394 auid=4294967295 uid=81
gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295
comm="dbus-daemon-lau"
exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus"
EUID="root" SUID="root" FSUID="root" EGID="dbus"
SGID="dbus" FSGID="dbus"
type=PROCTITLE msg=audit(1617801768.907:47755):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7450726976696C65676564
type=AVC msg=audit(1617801768.907:47756): avc: denied { net_admin } for pid=280394
comm="dbus-daemon-lau" capability=12
scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0
type=SYSCALL msg=audit(1617801768.907:47756): arch=c000003e syscall=54 success=no exit=-1
a0=6 a1=1 a2=20 a3=7ffec59c2f80 items=0 ppid=280393 pid=280394 auid=4294967295 uid=81
gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295
comm="dbus-daemon-lau"
exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper"
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus"
EUID="root" SUID="root" FSUID="root" EGID="dbus"
SGID="dbus" FSGID="dbus"
type=PROCTITLE msg=audit(1617801768.907:47756):
proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7450726976696C65676564
type=AVC msg=audit(1617801768.910:47757): avc: denied { noatsecure } for pid=280394
comm="dbus-daemon-lau" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process
permissive=0
type=AVC msg=audit(1617801768.910:47757): avc: denied { rlimitinh } for pid=280394
comm="SetroubleshootP" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process
permissive=0
type=AVC msg=audit(1617801768.910:47757): avc: denied { siginh } for pid=280394
comm="SetroubleshootP" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process
permissive=0
type=SYSCALL msg=audit(1617801768.910:47757): arch=c000003e syscall=59 success=yes exit=0
a0=5613f94d0c40 a1=5613f94d2370 a2=5613f94ce8f0 a3=1 items=2 ppid=280393 pid=280394
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=4294967295 comm="SetroubleshootP"
exe="/usr/libexec/platform-python3.6"
subj=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64
SYSCALL=execve AUID="unset" UID="root" GID="root"
EUID="root" SUID="root" FSUID="root" EGID="root"
SGID="root" FSGID="root"
type=EXECVE msg=audit(1617801768.910:47757): argc=2
a0="/usr/libexec/platform-python"
a1="/usr/share/setroubleshoot/SetroubleshootPrivileged.py"
type=CWD msg=audit(1617801768.910:47757): cwd="/"
type=PATH msg=audit(1617801768.910:47757): item=0
name="/usr/libexec/platform-python" inode=269287 dev=fd:00 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1617801768.910:47757): item=1
name="/lib64/ld-linux-x86-64.so.2" inode=25347812 dev=fd:00 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1617801768.910:47757):
_______________________________________________
Podman mailing list --podman(a)lists.podman.io
To unsubscribe send an email topodman-leave(a)lists.podman.io
Could you enable the virt_use_samba boolean.
# setsebool -P virt_use_samba 1
Then it should work.
1070
days inactive
1120
days old
18 comments
5 participants
participants (5)
-
Alessandro Bernardi -
Daniel Walsh -
rem＠llgc.org.uk -
Remi Malessa
-
Scott McCarty