CIFS share as a volume
Hi, I have a problem mapping a cifs network share to a container. It's an auto-mount and from the /etc/auto.mnt I can see it's mounted with: -fstype=cifs,rw,noperm,vers=3.0 The mount is attached to the /mnt/share-name I run image of the container with: sudo podman run --pod pod-name --detach --name container-name -v /mnt/share-name:/usr/src/app/share:rw,z ......... I get: Error: failed to set file label on /mnt/share-name: operation not supported Wonder if anybody could help me and point me to the right direction. Thanks
Rem, My guess would be CIFS doesn't support SELinux, so when it tries to label the mount point it fails. Try and run without SELinux enabled. Try --privileged as a quick and dirty, but I believe there is a --security-opt= label to just disable SELinux. Best Regards Scott M On Thu, Apr 1, 2021 at 3:32 AM <rem@llgc.org.uk> wrote:
Hi, I have a problem mapping a cifs network share to a container. It's an auto-mount and from the /etc/auto.mnt I can see it's mounted with: -fstype=cifs,rw,noperm,vers=3.0 The mount is attached to the /mnt/share-name
I run image of the container with: sudo podman run --pod pod-name --detach --name container-name -v /mnt/share-name:/usr/src/app/share:rw,z .........
I get: Error: failed to set file label on /mnt/share-name: operation not supported
Wonder if anybody could help me and point me to the right direction.
Thanks _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
-- -- 18 ways to differentiate open source products from upstream suppliers: https://opensource.com/article/21/2/differentiating-products-upstream-suppli... -- Scott McCarty Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty@redhat.com Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com
Hi Scott, Thanks for the hint. I've tried with --priviliged and it kind of went ahead, but stopped at a single file that resides on the share with "Error: failed to set file label on file_location_here operation not supported" So maybe I will manage to get it to work with the sysadmins. Best regards Remi
On 4/1/21 11:44, rem@llgc.org.uk wrote:
Hi Scott, Thanks for the hint. I've tried with --priviliged and it kind of went ahead, but stopped at a single file that resides on the share with "Error: failed to set file label on file_location_here operation not supported" So maybe I will manage to get it to work with the sysadmins.
Best regards Remi _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
Remove the ,z flag on the volume mount, this should work without the --privileged flag.
Thanks for the hint Daniel. It does work, but not without --privileged option. Without the option I get access denied from the container. With the parameter I can read and write and it's all visible outside of the container. Thanks Remi
On 4/6/21 03:25, Remi Malessa wrote:
Thanks for the hint Daniel. It does work, but not without --privileged option. Without the option I get access denied from the container. With the parameter I can read and write and it's all visible outside of the container.
Thanks Remi _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
What AVCs are you seeing?
Daniel, Nothing actually pop-up in the audit.log when I get : ls: cannot open directory '.': Permission denied ...inside the container. It's funny, because I can navigate the directories on the remote share (although I can't list them. I can even see content of text files.
On 4/6/21 13:42, Remi Malessa wrote:
Daniel, Nothing actually pop-up in the audit.log when I get :
ls: cannot open directory '.': Permission denied
...inside the container.
It's funny, because I can navigate the directories on the remote share (although I can't list them. I can even see content of text files. _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
Can you do `semodule -DB` on the host Then try to access the directory Gather the AVCs about container_t. Then `semodule -B` on the host to turn off dontaudit rules.
Thanks for your time Daniel, here's what appear in the audit when I run "ls" : type=AVC msg=audit(1617801763.586:47751): avc: denied { read } for pid=280379 comm="ls" name="Validation" dev="cifs" ino=281474976710700 scontext=system_u:system_r:container_t:s0:c100,c420 tcontext=system_u:object_r:cifs_t:s0 tclass=dir permissive=0 type=SYSCALL msg=audit(1617801763.586:47751): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=555e8b326210 a2=90800 a3=0 items=0 ppid=280171 pid=280379 auid=724607387 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1058 comm="ls" exe="/bin/ls" subj=system_u:system_r:container_t:s0:c100,c420 key=(null)ARCH=x86_64 SYSCALL=openat AUID="rem" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=PROCTITLE msg=audit(1617801763.586:47751): proctitle=6C73002D6C type=AVC msg=audit(1617801766.605:47752): avc: denied { net_admin } for pid=280381 comm="dbus-daemon-lau" capability=12 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=SYSCALL msg=audit(1617801766.605:47752): arch=c000003e syscall=54 success=no exit=-1 a0=5 a1=1 a2=21 a3=7ffdff2d9a50 items=0 ppid=280380 pid=280381 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus" EUID="root" SUID="root" FSUID="root" EGID="dbus" SGID="dbus" FSGID="dbus" type=PROCTITLE msg=audit(1617801766.605:47752): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464 type=AVC msg=audit(1617801766.605:47753): avc: denied { net_admin } for pid=280381 comm="dbus-daemon-lau" capability=12 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=SYSCALL msg=audit(1617801766.605:47753): arch=c000003e syscall=54 success=no exit=-1 a0=5 a1=1 a2=20 a3=7ffdff2d9a50 items=0 ppid=280380 pid=280381 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus" EUID="root" SUID="root" FSUID="root" EGID="dbus" SGID="dbus" FSGID="dbus" type=PROCTITLE msg=audit(1617801766.605:47753): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464 type=AVC msg=audit(1617801766.608:47754): avc: denied { noatsecure } for pid=280381 comm="dbus-daemon-lau" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1617801766.608:47754): avc: denied { rlimitinh } for pid=280381 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1617801766.608:47754): avc: denied { siginh } for pid=280381 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0 type=SYSCALL msg=audit(1617801766.608:47754): arch=c000003e syscall=59 success=yes exit=0 a0=5592801eaad0 a1=5592801eaa20 a2=5592801e88f0 a3=0 items=2 ppid=280380 pid=280381 auid=4294967295 uid=990 gid=987 euid=990 suid=990 fsuid=990 egid=987 sgid=987 fsgid=987 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/libexec/platform-python3.6" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="unset" UID="setroubleshoot" GID="setroubleshoot" EUID="setroubleshoot" SUID="setroubleshoot" FSUID="setroubleshoot" EGID="setroubleshoot" SGID="setroubleshoot" FSGID="setroubleshoot" type=EXECVE msg=audit(1617801766.608:47754): argc=5 a0="/usr/libexec/platform-python" a1="-Es" a2="/usr/sbin/setroubleshootd" a3="-f" a4="" type=CWD msg=audit(1617801766.608:47754): cwd="/" type=PATH msg=audit(1617801766.608:47754): item=0 name="/usr/libexec/platform-python" inode=269287 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root" type=PATH msg=audit(1617801766.608:47754): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=25347812 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root" type=PROCTITLE msg=audit(1617801766.608:47754): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464 type=AVC msg=audit(1617801768.907:47755): avc: denied { net_admin } for pid=280394 comm="dbus-daemon-lau" capability=12 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=SYSCALL msg=audit(1617801768.907:47755): arch=c000003e syscall=54 success=no exit=-1 a0=6 a1=1 a2=21 a3=7ffec59c2f80 items=0 ppid=280393 pid=280394 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus" EUID="root" SUID="root" FSUID="root" EGID="dbus" SGID="dbus" FSGID="dbus" type=PROCTITLE msg=audit(1617801768.907:47755): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7450726976696C65676564 type=AVC msg=audit(1617801768.907:47756): avc: denied { net_admin } for pid=280394 comm="dbus-daemon-lau" capability=12 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=SYSCALL msg=audit(1617801768.907:47756): arch=c000003e syscall=54 success=no exit=-1 a0=6 a1=1 a2=20 a3=7ffec59c2f80 items=0 ppid=280393 pid=280394 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus" EUID="root" SUID="root" FSUID="root" EGID="dbus" SGID="dbus" FSGID="dbus" type=PROCTITLE msg=audit(1617801768.907:47756): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7450726976696C65676564 type=AVC msg=audit(1617801768.910:47757): avc: denied { noatsecure } for pid=280394 comm="dbus-daemon-lau" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1617801768.910:47757): avc: denied { rlimitinh } for pid=280394 comm="SetroubleshootP" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1617801768.910:47757): avc: denied { siginh } for pid=280394 comm="SetroubleshootP" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process permissive=0 type=SYSCALL msg=audit(1617801768.910:47757): arch=c000003e syscall=59 success=yes exit=0 a0=5613f94d0c40 a1=5613f94d2370 a2=5613f94ce8f0 a3=1 items=2 ppid=280393 pid=280394 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="SetroubleshootP" exe="/usr/libexec/platform-python3.6" subj=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=EXECVE msg=audit(1617801768.910:47757): argc=2 a0="/usr/libexec/platform-python" a1="/usr/share/setroubleshoot/SetroubleshootPrivileged.py" type=CWD msg=audit(1617801768.910:47757): cwd="/" type=PATH msg=audit(1617801768.910:47757): item=0 name="/usr/libexec/platform-python" inode=269287 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root" type=PATH msg=audit(1617801768.910:47757): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=25347812 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root" type=PROCTITLE msg=audit(1617801768.910:47757):
Daniel, my sysadmin has fixed the problem with SELinux. Thank you very much for the hints. Kind regards Remi
Remi, I'm curious, do you know what was going on or how they fixed it? Would be good for all of us to know for when the next person asks :-) Best Regards Scott M On Fri, Apr 9, 2021 at 3:16 AM Remi Malessa <rem@llgc.org.uk> wrote:
Daniel, my sysadmin has fixed the problem with SELinux. Thank you very much for the hints.
Kind regards Remi _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
-- -- 18 ways to differentiate open source products from upstream suppliers: https://opensource.com/article/21/2/differentiating-products-upstream-suppli... -- Scott McCarty Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty@redhat.com Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com
Hi Scott,I tried to reproduce the error reported by Remi.I fixed it by adding the option context="system_u:object_r:container_file_t:s0" to the mount command. You can find more details at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/htm... . I wait Remi's answer too ;) Kind regards,Alessandro Bernardi Il venerdì 9 aprile 2021, 15:07:53 CEST, Scott McCarty <smccarty@redhat.com> ha scritto: Remi, I'm curious, do you know what was going on or how they fixed it? Would be good for all of us to know for when the next person asks :-) Best RegardsScott M On Fri, Apr 9, 2021 at 3:16 AM Remi Malessa <rem@llgc.org.uk> wrote: Daniel, my sysadmin has fixed the problem with SELinux. Thank you very much for the hints. Kind regards Remi _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io -- --18 ways to differentiate open source products from upstream suppliers: https://opensource.com/article/21/2/differentiating-products-upstream-suppli... -- Scott McCarty Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty@redhat.com Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
On 4/9/21 09:03, Scott McCarty wrote:
Remi, I'm curious, do you know what was going on or how they fixed it? Would be good for all of us to know for when the next person asks :-)
I took the AVCs reported and ran them through audit2allow. ``` audit2allow -i /tmp/t #============= container_t ============== #!!!! This avc can be allowed using the boolean 'virt_use_samba' allow container_t cifs_t:dir read; ... ``` But I would prefer you to think I am a real genius. :^)
Best Regards Scott M
On Fri, Apr 9, 2021 at 3:16 AM Remi Malessa <rem@llgc.org.uk <mailto:rem@llgc.org.uk>> wrote:
Daniel, my sysadmin has fixed the problem with SELinux. Thank you very much for the hints.
Kind regards Remi _______________________________________________ Podman mailing list -- podman@lists.podman.io <mailto:podman@lists.podman.io> To unsubscribe send an email to podman-leave@lists.podman.io <mailto:podman-leave@lists.podman.io>
-- -- 18 ways to differentiate open source products from upstream suppliers:https://opensource.com/article/21/2/differentiating-products-upstream-suppli... <https://opensource.com/article/21/2/differentiating-products-upstream-suppliers> -- Scott McCarty Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty@redhat.com <mailto:smccarty@redhat.com> Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com <http://crunchtools.com>
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
Scott, I asked the sysadmin, but he does not know / don't remember the exact rules that fixed. We will be moving to a production server at some point, then we will be dealing with (likely) exactly the same problem. He said he may try to answer the question then. I will update the thread when this happen. Sorry Remi
Sounds good! Thanks for checking. On Tue, Apr 13, 2021, 7:08 AM Remi Malessa <rem@llgc.org.uk> wrote:
Scott, I asked the sysadmin, but he does not know / don't remember the exact rules that fixed.
We will be moving to a production server at some point, then we will be dealing with (likely) exactly the same problem. He said he may try to answer the question then. I will update the thread when this happen.
Sorry Remi _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
This is what he said: "(..)so I used the tool and flags “audit2allow -a -w” this showed me the issues that were denying based on the SELinux baseline for the box. From here you can follow the recommendations (the setbool command I mentioned) and also you can use “audit2allow -a -M somepolicy” to create a policy to install (you do this using semodule -i somepolicy.pp) In our case I could apply this as there were only those rules to apply, but you would probably want to be more granular on most systems for example: grep yourService /var/log/audit/audit.log | audit2allow -M anotherPolicy && semodule –i anotherPolicy.pp(...)"
On 4/13/21 07:16, Remi Malessa wrote:
This is what he said:
"(..)so I used the tool and flags “audit2allow -a -w” this showed me the issues that were denying based on the SELinux baseline for the box. From here you can follow the recommendations (the setbool command I mentioned) and also you can use “audit2allow -a -M somepolicy” to create a policy to install (you do this using semodule -i somepolicy.pp)
In our case I could apply this as there were only those rules to apply, but you would probably want to be more granular on most systems for example:
grep yourService /var/log/audit/audit.log | audit2allow -M anotherPolicy && semodule –i anotherPolicy.pp(...)" _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
I would just turn on the boolean. If you see more AVCs about container_t then you should report them as issues on container-selinux.
Hi, the admin used this: ```setsebool -P virt_use_samba 1``` Also , there were some problems on the file permissions for the remote directories. Hope this helps, thanks. Remi
On 4/8/21 04:57, Remi Malessa wrote:
Thanks for your time Daniel, here's what appear in the audit when I run "ls" :
type=AVC msg=audit(1617801763.586:47751): avc: denied { read } for pid=280379 comm="ls" name="Validation" dev="cifs" ino=281474976710700 scontext=system_u:system_r:container_t:s0:c100,c420 tcontext=system_u:object_r:cifs_t:s0 tclass=dir permissive=0 type=SYSCALL msg=audit(1617801763.586:47751): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=555e8b326210 a2=90800 a3=0 items=0 ppid=280171 pid=280379 auid=724607387 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1058 comm="ls" exe="/bin/ls" subj=system_u:system_r:container_t:s0:c100,c420 key=(null)ARCH=x86_64 SYSCALL=openat AUID="rem" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=PROCTITLE msg=audit(1617801763.586:47751): proctitle=6C73002D6C type=AVC msg=audit(1617801766.605:47752): avc: denied { net_admin } for pid=280381 comm="dbus-daemon-lau" capability=12 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=SYSCALL msg=audit(1617801766.605:47752): arch=c000003e syscall=54 success=no exit=-1 a0=5 a1=1 a2=21 a3=7ffdff2d9a50 items=0 ppid=280380 pid=280381 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus" EUID="root" SUID="root" FSUID="root" EGID="dbus" SGID="dbus" FSGID="dbus" type=PROCTITLE msg=audit(1617801766.605:47752): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464 type=AVC msg=audit(1617801766.605:47753): avc: denied { net_admin } for pid=280381 comm="dbus-daemon-lau" capability=12 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=SYSCALL msg=audit(1617801766.605:47753): arch=c000003e syscall=54 success=no exit=-1 a0=5 a1=1 a2=20 a3=7ffdff2d9a50 items=0 ppid=280380 pid=280381 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus" EUID="root" SUID="root" FSUID="root" EGID="dbus" SGID="dbus" FSGID="dbus" type=PROCTITLE msg=audit(1617801766.605:47753): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464 type=AVC msg=audit(1617801766.608:47754): avc: denied { noatsecure } for pid=280381 comm="dbus-daemon-lau" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1617801766.608:47754): avc: denied { rlimitinh } for pid=280381 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1617801766.608:47754): avc: denied { siginh } for pid=280381 comm="setroubleshootd" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tclass=process permissive=0 type=SYSCALL msg=audit(1617801766.608:47754): arch=c000003e syscall=59 success=yes exit=0 a0=5592801eaad0 a1=5592801eaa20 a2=5592801e88f0 a3=0 items=2 ppid=280380 pid=280381 auid=4294967295 uid=990 gid=987 euid=990 suid=990 fsuid=990 egid=987 sgid=987 fsgid=987 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/libexec/platform-python3.6" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="unset" UID="setroubleshoot" GID="setroubleshoot" EUID="setroubleshoot" SUID="setroubleshoot" FSUID="setroubleshoot" EGID="setroubleshoot" SGID="setroubleshoot" FSGID="setroubleshoot" type=EXECVE msg=audit(1617801766.608:47754): argc=5 a0="/usr/libexec/platform-python" a1="-Es" a2="/usr/sbin/setroubleshootd" a3="-f" a4="" type=CWD msg=audit(1617801766.608:47754): cwd="/" type=PATH msg=audit(1617801766.608:47754): item=0 name="/usr/libexec/platform-python" inode=269287 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root" type=PATH msg=audit(1617801766.608:47754): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=25347812 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root" type=PROCTITLE msg=audit(1617801766.608:47754): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7464 type=AVC msg=audit(1617801768.907:47755): avc: denied { net_admin } for pid=280394 comm="dbus-daemon-lau" capability=12 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=SYSCALL msg=audit(1617801768.907:47755): arch=c000003e syscall=54 success=no exit=-1 a0=6 a1=1 a2=21 a3=7ffec59c2f80 items=0 ppid=280393 pid=280394 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus" EUID="root" SUID="root" FSUID="root" EGID="dbus" SGID="dbus" FSGID="dbus" type=PROCTITLE msg=audit(1617801768.907:47755): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7450726976696C65676564 type=AVC msg=audit(1617801768.907:47756): avc: denied { net_admin } for pid=280394 comm="dbus-daemon-lau" capability=12 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=SYSCALL msg=audit(1617801768.907:47756): arch=c000003e syscall=54 success=no exit=-1 a0=6 a1=1 a2=20 a3=7ffec59c2f80 items=0 ppid=280393 pid=280394 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/usr/libexec/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=setsockopt AUID="unset" UID="dbus" GID="dbus" EUID="root" SUID="root" FSUID="root" EGID="dbus" SGID="dbus" FSGID="dbus" type=PROCTITLE msg=audit(1617801768.907:47756): proctitle=2F2F7573722F6C6962657865632F646275732D312F646275732D6461656D6F6E2D6C61756E63682D68656C706572006F72672E6665646F726170726F6A6563742E536574726F75626C6573686F6F7450726976696C65676564 type=AVC msg=audit(1617801768.910:47757): avc: denied { noatsecure } for pid=280394 comm="dbus-daemon-lau" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1617801768.910:47757): avc: denied { rlimitinh } for pid=280394 comm="SetroubleshootP" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1617801768.910:47757): avc: denied { siginh } for pid=280394 comm="SetroubleshootP" scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 tclass=process permissive=0 type=SYSCALL msg=audit(1617801768.910:47757): arch=c000003e syscall=59 success=yes exit=0 a0=5613f94d0c40 a1=5613f94d2370 a2=5613f94ce8f0 a3=1 items=2 ppid=280393 pid=280394 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="SetroubleshootP" exe="/usr/libexec/platform-python3.6" subj=system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=execve AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" type=EXECVE msg=audit(1617801768.910:47757): argc=2 a0="/usr/libexec/platform-python" a1="/usr/share/setroubleshoot/SetroubleshootPrivileged.py" type=CWD msg=audit(1617801768.910:47757): cwd="/" type=PATH msg=audit(1617801768.910:47757): item=0 name="/usr/libexec/platform-python" inode=269287 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root" type=PATH msg=audit(1617801768.910:47757): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=25347812 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root" type=PROCTITLE msg=audit(1617801768.910:47757): _______________________________________________ Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
Could you enable the virt_use_samba boolean. # setsebool -P virt_use_samba 1 Then it should work.
participants (5)
-
Alessandro Bernardi -
Daniel Walsh -
rem＠llgc.org.uk -
Remi Malessa
-
Scott McCarty