{"action":"closed","issue":{"url":"https://api.github.com/repos/coreos/bugs/issues/972","labels_url":"https://api.github.com/repos/coreos/bugs/issues/972/labels{/name}","comments_url":"https://api.github.com/repos/coreos/bugs/issues/972/comments","events_url":"https://api.github.com/repos/coreos/bugs/issues/972/events","html_url":"https://github.com/coreos/bugs/issues/972","id":116261308,"number":972,"title":"SELinux doesn't contain Docker containers","user":{"login":"tjdett","id":437845,"avatar_url":"https://avatars.githubusercontent.com/u/437845?v=3","gravatar_id":"","url":"https://api.github.com/users/tjdett","html_url":"https://github.com/tjdett","followers_url":"https://api.github.com/users/tjdett/followers","following_url":"https://api.github.com/users/tjdett/following{/other_user}","gists_url":"https://api.github.com/users/tjdett/gists{/gist_id}","starred_url":"https://api.github.com/users/tjdett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tjdett/subscriptions","organizations_url":"https://api.github.com/users/tjdett/orgs","repos_url":"https://api.github.com/users/tjdett/repos","events_url":"https://api.github.com/users/tjdett/events{/privacy}","received_events_url":"https://api.github.com/users/tjdett/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-11T04:16:59Z","updated_at":"2015-11-11T05:39:15Z","closed_at":"2015-11-11T05:39:15Z","body":"On a clean 845.0,  following:\r\n```\r\nrm /etc/audit/rules.d/80-selinux.rules\r\nrm /etc/audit/rules.d/99-default.rules\r\nrm /var/lib/selinux; cp -a /usr/lib/selinux/policy /var/lib/selinux\r\nrm /etc/selinux/mcs; cp -a /usr/lib/selinux/mcs /etc/selinux/\r\nsemodule -DB\r\nsystemctl restart audit-rules\r\nsetenforce 1\r\nsystemctl restart docker\r\n```\r\n\r\nDocker runs as `kernel_t`:\r\n```\r\n$ ps -efZ | grep docker\r\nsystem_u:system_r:kernel_t:s0   root      1792     1  0 04:04 ?        00:00:00 docker daemon --host=fd://\r\n```\r\n\r\nand as a result Docker containers are unrestricted in their access to the filesystem:\r\n```\r\n$ getenforce && docker run -ti --rm -v /etc:/mnt/etc alpine:3.2 sh -c \"echo foo > /mnt/etc/test\" && cat /etc/test\r\nEnforcing\r\nfoo\r\n```\r\n"}}