dockerd-rootless.sh: avoid /run/xtables.lock EACCES on SELinux hosts#42199
Conversation
AkihiroSuda
added
area/security/selinux
area/rootless
contrib/dockerd-rootless.sh
Outdated
There was a problem hiding this comment.
Note: I also tried /run/dockerd-rootless-xtables.lock, $(mktemp -d /tmp/dir.XXXXXXXX)/xtables.lock, ${ROOTLESSKIT_STATE_DIR}/xtables.lock, $HOME/.docker/run/xtables.lock, but none of them could satisfy SELinux😅
It seems only a file under /tmp can work.
There was a problem hiding this comment.
@giuseppe Do you happen to know whether this is by design?
There was a problem hiding this comment.
no idea :) what error do you see?
Could you force a system_u:object_r:iptables_var_run_t:s0 label on the file?
There was a problem hiding this comment.
can't open lock file /run/user/1000/dockerd-rootless-xtables.lock: Permission denied error.
I tried touch /run/user/1000/dockerd-rootless-xtables.lock && chcon system_u:object_r:iptables_var_run_t:s0 /run/user/1000/dockerd-rootless-xtables.lock but same error
There was a problem hiding this comment.
Updated to use chcon system_u:object_r:iptables_var_run_t:s0 /run.
AkihiroSuda
force-pushed
the
rootless-selinux-xtables-workaround
branch
2 times, most recently
from
66300a9 to
54b4466
Compare
Previously, running dockerd-rootless.sh on SELinux-enabled hosts was failing with "can't open lock file /run/xtables.lock: Permission denied" error. (issue 41230). This commit avoids hitting the error by relabeling /run in the RootlessKit child. The actual /run on the parent is unaffected. https://github.com/containers/podman/blob/e6fc34b71aa9d876b1218efe90e14f8b912b0603/libpod/networking_linux.go#L396-L401 Tested on Fedora 34 Signed-off-by: Akihiro Suda <[email protected]>
AkihiroSuda
force-pushed
the
rootless-selinux-xtables-workaround
branch
from
54b4466 to
cdaf82b
Compare
| rm -f /run/docker /run/containerd /run/xtables.lock | ||
|
|
||
| if [ -n "$_DOCKERD_ROOTLESS_SELINUX" ]; then | ||
| # iptables requires /run in the child to be relabeled. The actual /run in the parent is unaffected. | ||
| # https://github.com/containers/podman/blob/e6fc34b71aa9d876b1218efe90e14f8b912b0603/libpod/networking_linux.go#L396-L401 | ||
| # https://github.com/moby/moby/issues/41230 | ||
| chcon system_u:object_r:iptables_var_run_t:s0 /run | ||
| fi |
There was a problem hiding this comment.
Wondering; should this be seen as a temporary approach (and ultimately be handled by rootlesskit or dockerd itself?)
There was a problem hiding this comment.
Ideally this could be fixed on the selinux policy package of RHEL/Fedora, however, given that even Podman has the same workaround, this workaround is likely to be permanent.
There was a problem hiding this comment.
Ach, missed your reply; meant to say; if we'll need this, would it be possible to move this step into the go code (dockerd or rootless kit) so that the bash script can be simplified (ideally the script would only have to do minimal steps to configure the daemon to run in rootless mode)
It's ok for now to use the script, but just rather would have the script small (if possible)
There was a problem hiding this comment.
I'd prefer to keep this in the script.
Other distros/versions may have different policies for SELinux, and may require different chcon workarounds. The script is intended to be modifiable for such workarounds.
thaJeztah
left a comment
thaJeztah
left a comment
There was a problem hiding this comment.
LGTM
but left a question (for a follow up?)
|
Cherry-pick to 20.10: #42462 |
4 participants
- What I did
Fix #41230
- How I did it
Previously, running dockerd-rootless.sh on SELinux-enabled hosts was failing with
can't open lock file /run/xtables.lock: Permission deniederror. (issue #41230).This commit avoids hitting the error by relabeling /run in the RootlessKit child.
The actual /run on the parent is unaffected.
https://github.com/containers/podman/blob/e6fc34b71aa9d876b1218efe90e14f8b912b0603/libpod/networking_linux.go#L396-L401
- How to verify it
can't open lock file /run/xtables.lock: Permission deniederror- Description for the changelog
dockerd-rootless.sh: avoid
can't open lock file /run/xtables.lock: Permission deniederrorSELinux hosts- A picture of a cute animal (not mandatory but encouraged)
🐧