Skip to content

Instantly share code, notes, and snippets.

@pmorie

pmorie/1. AVC Denials, no policy

Last active August 29, 2015 14:18
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save pmorie/ccc936b83b5baea8f4e4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save pmorie/ccc936b83b5baea8f4e4 to your computer and use it in GitHub Desktop.
Download ZIP
EmptyDir RW SELinux Denials
Raw
1. AVC Denials, no policy
$ sudo ausearch -ts recent -m AVC | grep comm=\"mt\"
type=AVC msg=audit(1428639294.464:499250): avc: denied { rlimitinh } for pid=6215 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c239,c1010 tclass=process permissive=1
type=AVC msg=audit(1428639294.464:499251): avc: denied { siginh } for pid=6215 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c239,c1010 tclass=process permissive=1
type=AVC msg=audit(1428639294.464:499252): avc: denied { noatsecure } for pid=6215 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c239,c1010 tclass=process permissive=1
type=AVC msg=audit(1428639294.470:499253): avc: denied { create } for pid=6215 comm="mt" name="test-file" scontext=system_u:system_r:svirt_lxc_net_t:s0:c239,c1010 tcontext=system_u:object_r:docker_var_lib_t:s0 tclass=file permissive=0
type=AVC msg=audit(1428639299.242:499404): avc: denied { rlimitinh } for pid=6418 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c51,c516 tclass=process permissive=1
type=AVC msg=audit(1428639299.242:499405): avc: denied { siginh } for pid=6418 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c51,c516 tclass=process permissive=1
type=AVC msg=audit(1428639299.242:499406): avc: denied { noatsecure } for pid=6418 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c51,c516 tclass=process permissive=1
Raw
2. kubernetes_svirt_lxc_net_t_create.te
module kubernetes_svirt_lxc_net_t_create 1.0;
require {
type svirt_lxc_net_t;
type docker_var_lib_t;
class file create;
}
#============= svirt_lxc_net_t ==============
allow svirt_lxc_net_t docker_var_lib_t:file create;
Raw
3. AVC Denials, with create policy installed
$ sudo ausearch -ts recent -m AVC | grep comm=\"mt\"
[sudo] password for pmorie:
type=AVC msg=audit(1428639995.310:500134): avc: denied { rlimitinh } for pid=9944 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c272,c636 tclass=process permissive=1
type=AVC msg=audit(1428639995.310:500135): avc: denied { siginh } for pid=9944 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c272,c636 tclass=process permissive=1
type=AVC msg=audit(1428639995.311:500136): avc: denied { noatsecure } for pid=9944 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c272,c636 tclass=process permissive=1
type=AVC msg=audit(1428640000.446:500289): avc: denied { rlimitinh } for pid=10102 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c108,c800 tclass=process permissive=1
type=AVC msg=audit(1428640000.446:500290): avc: denied { siginh } for pid=10102 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c108,c800 tclass=process permissive=1
type=AVC msg=audit(1428640000.447:500291): avc: denied { noatsecure } for pid=10102 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c108,c800 tclass=process permissive=1
type=AVC msg=audit(1428640000.449:500292): avc: denied { write open } for pid=10102 comm="mt" path="/test-volume/test-file" dev="tmpfs" ino=21888834 scontext=system_u:system_r:svirt_lxc_net_t:s0:c108,c800 tcontext=system_u:object_r:docker_var_lib_t:s0 tclass=file permissive=0
type=AVC msg=audit(1428640000.449:500293): avc: denied { getattr } for pid=10102 comm="mt" path="/test-volume/test-file" dev="tmpfs" ino=21888834 scontext=system_u:system_r:svirt_lxc_net_t:s0:c108,c800 tcontext=system_u:object_r:docker_var_lib_t:s0 tclass=file permissive=0
Raw
4. kubernetes_svirt_lxc_net_t_write_open.te
module kubernetes_svirt_lxc_net_t_write_open 1.0;
require {
type svirt_lxc_net_t;
type docker_var_lib_t;
class file read;
}
#============= svirt_lxc_net_t ==============
allow svirt_lxc_net_t docker_var_lib_t:file read;
Raw
5. Denials with both policies active
$ sudo semodule -l
kubernetes_svirt_lxc_net_t_create 1.0
kubernetes_svirt_lxc_net_t_write_open 1.0
$ sudo ausearch -ts recent -m AVC | grep comm=\"mt\"
type=AVC msg=audit(1428677912.468:507748): avc: denied { rlimitinh } for pid=9471 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c409,c994 tclass=process permissive=1
type=AVC msg=audit(1428677912.468:507749): avc: denied { siginh } for pid=9471 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c409,c994 tclass=process permissive=1
type=AVC msg=audit(1428677912.468:507750): avc: denied { noatsecure } for pid=9471 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c409,c994 tclass=process permissive=1
type=AVC msg=audit(1428677917.669:507902): avc: denied { rlimitinh } for pid=9625 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c276,c596 tclass=process permissive=1
type=AVC msg=audit(1428677917.669:507903): avc: denied { siginh } for pid=9625 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c276,c596 tclass=process permissive=1
type=AVC msg=audit(1428677917.669:507904): avc: denied { noatsecure } for pid=9625 comm="mt" scontext=system_u:system_r:docker_t:s0 tcontext=system_u:system_r:svirt_lxc_net_t:s0:c276,c596 tclass=process permissive=1
type=AVC msg=audit(1428677917.679:507905): avc: denied { write open } for pid=9625 comm="mt" path="/test-volume/test-file" dev="tmpfs" ino=22118275 scontext=system_u:system_r:svirt_lxc_net_t:s0:c276,c596 tcontext=system_u:object_r:docker_var_lib_t:s0 tclass=file permissive=0
type=AVC msg=audit(1428677917.679:507906): avc: denied { getattr } for pid=9625 comm="mt" path="/test-volume/test-file" dev="tmpfs" ino=22118275 scontext=system_u:system_r:svirt_lxc_net_t:s0:c276,c596 tcontext=system_u:object_r:docker_var_lib_t:s0 tclass=file permissive=0
Raw
6 chcon
$ sudo chcon -R unconfined_u:object_r:svirt_sandbox_file_t /var/lib/kubelet/
chcon: failed to change context of ‘tmpfs’ to ‘unconfined_u:object_r:svirt_sandbox_file_t’: Invalid argument
chcon: failed to change context of ‘plugins’ to ‘unconfined_u:object_r:svirt_sandbox_file_t’: Invalid argument
chcon: failed to change context of ‘pods’ to ‘unconfined_u:object_r:svirt_sandbox_file_t’: Invalid argument
chcon: failed to change context of ‘/var/lib/kubelet/’ to ‘unconfined_u:object_r:svirt_sandbox_file_t’: Invalid argument
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment