{"action":"created","issue":{"url":"https://api.github.com/repos/projectatomic/atomic-site/issues/141","labels_url":"https://api.github.com/repos/projectatomic/atomic-site/issues/141/labels{/name}","comments_url":"https://api.github.com/repos/projectatomic/atomic-site/issues/141/comments","events_url":"https://api.github.com/repos/projectatomic/atomic-site/issues/141/events","html_url":"https://github.com/projectatomic/atomic-site/issues/141","id":87338571,"number":141,"title":"Blog: Sharing volumes in Docker with SELinux.","user":{"login":"rhatdan","id":2000835,"avatar_url":"https://avatars.githubusercontent.com/u/2000835?v=3","gravatar_id":"","url":"https://api.github.com/users/rhatdan","html_url":"https://github.com/rhatdan","followers_url":"https://api.github.com/users/rhatdan/followers","following_url":"https://api.github.com/users/rhatdan/following{/other_user}","gists_url":"https://api.github.com/users/rhatdan/gists{/gist_id}","starred_url":"https://api.github.com/users/rhatdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhatdan/subscriptions","organizations_url":"https://api.github.com/users/rhatdan/orgs","repos_url":"https://api.github.com/users/rhatdan/repos","events_url":"https://api.github.com/users/rhatdan/events{/privacy}","received_events_url":"https://api.github.com/users/rhatdan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-11T13:01:50Z","updated_at":"2015-06-12T19:39:45Z","closed_at":null,"body":"### Using volumes with docker can cause problems with SELinux. \r\n\r\nWhen using SELinux for controlling processes within a container, you need to make sure any content that gets volume mounted into the container is readable and potentially\r\nwritable depending on the use case.\r\n\r\nBy default docker container processes run with the **system_u:system_r:svirt_lxc_net_t:s0** label.  **svirt_lxc_net_t** type is allowed to read/execute most content under /usr, but it is\r\nnot allowed to use most other types on the system.   If you want to volume mount content under /var for example into a container, you need to set the labels on this content.  In the docker run man page we mention this.\r\n\r\n```\r\nman docker-run\r\n...\r\n       When  using  SELinux,  be  aware that the host has no knowledge of container SELinux policy.\r\n       Therefore, in the above example, if SELinux policy  is  enforced,  the  /var/db  directory is not\r\n       writable to the container. A \"Permission Denied\" message will occur and an avc: message in\r\n       the host's syslog.\r\n\r\n       To  work  around  this, at time of writing this man page, the followingcommand needs to be run\r\n       in order for the  proper  SELinux  policy  type label to be attached to the host directory:\r\n\r\n              # chcon -Rt svirt_sandbox_file_t /var/db\r\n```\r\n\r\nThis got easier recently since Docker finally merged a patch which will be showing up in docker-1.7 (We have been carrying the patch in docker-1.6 on RHEL, Centos and Fedora).\r\nThis patch adds support for \"z\" and \"Z\" as options on the volume mounts (-v).\r\n\r\nFor example\r\n\r\n```\r\n  docker run -v /var/db:/var/db:z rhel7 /bin/sh\r\n```\r\nWill automatically do the `chcon -Rt svirt_sandbox_file_t /var/db` described in the man page.\r\n\r\nEven better,\r\n\r\n```\r\n  docker run -v /var/db:/var/db:Z rhel7 /bin/sh\r\n```\r\n\r\nwill label the content inside the container with the exact MCS label that the container will run with, basically it runs\r\n\r\n**chcon -Rt svirt_sandbox_file_t -l s0:c1,c2 /var/db** Where **s0:c1,c2** differs for each container.\r\n\r\nI have a bugzilla that was reported to me, that might become common.\r\n\r\n[https://bugzilla.redhat.com/show_bug.cgi?id=1230098](https://bugzilla.redhat.com/show_bug.cgi?id=1230098)\r\n\r\nThe user got AVC's that looked like the following.\r\n\r\n\r\nRaw Audit Messages\r\n\r\n_type=AVC msg=audit(1433926625.524:1347): avc:  denied  { write } for  pid=29280 comm=\"launch\" name=\"addons\" dev=\"dm-2\" ino=2491404 scontext=system_u:system_r:svirt_lxc_net_t:**s0:c147,c266** tcontext=system_u:object_r:svirt_sandbox_file_t:**s0:c372,c410** tclass=dir permissive=0_\r\n\r\nNotice the bolded MCS labels. \r\n\r\nThe problem here was the user created a volume and labeled it from one container with the \"Z\" for one container, then\r\nattempted to share it in another container.  Which SELinux denied since the MCS labels differed.  As I described in the bugzilla.\r\n\r\nI told the reporter that he need to mount it using Z or z, since at some point the volume got a different containers labels on it.\r\nYou container processes are running with this label, **system_u:system_r:svirt_lxc_net_t:s0:c147,c266** Notice the **s0:c147,c266**\r\nThe volume mount is labeled **system_u:object_r:svirt_sandbox_file_t:s0:c372,c410** Notice the MCS label **s0:c372,c410** MCS\r\nSecurity prevents read/write of content with different MCS labels. However it will low read/write of content labeled with an s0 label.\r\n\r\nIf you volume mount a image with *-v /SOURCE:/DESTINATION:z* docker will automatically  relabel the content for you to s0. If\r\nyou volume mount with a \"Z\", then the label will be specific to the container, and not be able to be shared between containers.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/projectatomic/atomic-site/issues/comments/111596714","html_url":"https://github.com/projectatomic/atomic-site/issues/141#issuecomment-111596714","issue_url":"https://api.github.com/repos/projectatomic/atomic-site/issues/141","id":111596714,"user":{"login":"rhatdan","id":2000835,"avatar_url":"https://avatars.githubusercontent.com/u/2000835?v=3","gravatar_id":"","url":"https://api.github.com/users/rhatdan","html_url":"https://github.com/rhatdan","followers_url":"https://api.github.com/users/rhatdan/followers","following_url":"https://api.github.com/users/rhatdan/following{/other_user}","gists_url":"https://api.github.com/users/rhatdan/gists{/gist_id}","starred_url":"https://api.github.com/users/rhatdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhatdan/subscriptions","organizations_url":"https://api.github.com/users/rhatdan/orgs","repos_url":"https://api.github.com/users/rhatdan/repos","events_url":"https://api.github.com/users/rhatdan/events{/privacy}","received_events_url":"https://api.github.com/users/rhatdan/received_events","type":"User","site_admin":false},"created_at":"2015-06-12T19:39:45Z","updated_at":"2015-06-12T19:39:45Z","body":"Sure go for it.\n\nOn 06/11/2015 11:20 AM, jzb wrote:\n>\n> Minor edits, OK?\n>\n>\n>       Using Volumes with Docker can Cause Problems with SELinux.\n>\n> When using SELinux for controlling processes within a container, you\n> need to make sure any content that gets volume mounted into the\n> container is readable, and potentially writable, depending on the use\n> case.\n>\n> By default, Docker container processes run with the\n> *system_u:system_r:svirt_lxc_net_t:s0* label. *svirt_lxc_net_t* type\n> is allowed to read/execute most content under /usr, but it is\n> not allowed to use most other types on the system.\n>\n> If you want to volume mount content under /var for example into a\n> container, you need to set the labels on this content. In the docker\n> run man page we mention this.\n>\n> |man docker-run\n> ...\n>        When  using  SELinux,  be  aware that the host has no knowledge of container SELinux policy.\n>        Therefore, in the above example, if SELinux policy  is enforced,  the /var/db directory is not\n>        writable to the container. A \"Permission Denied\" message will occur and an avc: message in\n>        the host's syslog.\n>\n>        To  work  around  this, at time of writing this man page, the following command needs to be run\n>        in order for the  proper  SELinux  policy  type label to be attached to the host directory:\n>\n>               # chcon -Rt svirt_sandbox_file_t /var/db\n> |\n>\n> This got easier recently since Docker finally merged a patch which\n> will be showing up in docker-1.7 (We have been carrying the patch in\n> docker-1.6 on RHEL, Centos and Fedora).\n>\n> This patch adds support for \"z\" and \"Z\" as options on the volume\n> mounts (-v).\n>\n> For example:\n>\n> |  docker run -v /var/db:/var/db:z rhel7 /bin/sh\n> |\n>\n> Will automatically do the |chcon -Rt svirt_sandbox_file_t /var/db|\n> described in the man page.\n>\n> Even better, you can use |Z|.\n>\n> |  docker run -v /var/db:/var/db:Z rhel7 /bin/sh\n> |\n>\n> This will label the content inside the container with the exact MCS\n> label that the container will run with, basically it runs |chcon -Rt\n> svirt_sandbox_file_t -l s0:c1,c2 /var/db| where *s0:c1,c2* differs for\n> each container.\n>\n> I have a bug <https://bugzilla.redhat.com/show_bug.cgi?id=1230098>\n> that was reported to me, that might become common. The user got AVC's\n> that looked like the following.\n>\n> Raw Audit Messages\n>\n> /type=AVC msg=audit(1433926625.524:1347): avc: denied { write } for\n> pid=29280 comm=\"launch\" name=\"addons\" dev=\"dm-2\" ino=2491404\n> scontext=system_u:system_r:svirt_lxc_net_t:*s0:c147,c266*\n> tcontext=system_u:object_r:svirt_sandbox_file_t:*s0:c372,c410*\n> tclass=dir permissive=0/\n>\n> Notice the bolded MCS labels.\n>\n> The problem here was the user created a volume and labeled it from one\n> container with the \"Z\" for one container, then attempted to share it\n> in another container. Which SELinux denied since the Multi-Category\n> Security (MCS) labels differed.\n>\n> I told the reporter that he needs to mount it using Z or z, since at\n> some point the volume got a different containers labels on it.\n>\n> Your container processes are running with this label,\n> *system_u:system_r:svirt_lxc_net_t:s0:c147,c266* Notice the *s0:c147,c266*\n> The volume mount is labeled\n> *system_u:object_r:svirt_sandbox_file_t:s0:c372,c410* Notice the MCS\n> label *s0:c372,c410* MCS Security prevents read/write of content with\n> different MCS labels. However it will allow read/write of content\n> labeled with an s0 label.\n>\n> If you volume mount a image with /-v /SOURCE:/DESTINATION:z/ docker\n> will automatically relabel the content for you to s0. If you volume\n> mount with a \"Z\", then the label will be specific to the container,\n> and not be able to be shared between containers.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/projectatomic/atomic-site/issues/141#issuecomment-111170387>.\n>\n\n"}}