Privileged container volumes are not relabeled #10209

basvdlei · 2021-05-04T16:52:43Z

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

Volumes of privileged containers are not relabeled since Podman v3.1.1 due to #9895. This makes it difficult to re-use volumes created by a privileged container from a non-privileged container, without resorting to manual/additional relabeling. This behavior is different from Docker and previous versions of Podman.

If this is indeed intended behavior. What would be the canonical way to make sure files created/written by a privileged container are accessible by other (non-privileged) containers?

Steps to reproduce the issue:

Create a privileged container with on a machine with SELinux enabled and set the relabel option -z:

mkdir ~/test
sudo podman run --rm --privileged -v "${HOME}/test:/shared:z" \
    registry.fedoraproject.org/fedora-minimal:33 touch /shared/hello.txt

Run a second non-privileged container to modify the file in the same volume:

sudo podman run --rm -v "${HOME}/test:/shared" \
    registry.fedoraproject.org/fedora-minimal:33 touch /shared/hello.txt

Describe the results you received:

Since the volume is not relabeled, the second container is not allowed to write:

touch: cannot touch '/shared/hello.txt': Permission denied

AVC avc:  denied  { write } for  pid=26356 comm="touch" name="hello.txt" dev="vda4" ino=10737064 scontext=system_u:system_r:container_t:s0:c36,c693 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0

Describe the results you expected:

Since the first container was started with the relabel option, I expected for the directory and files created to be labeled in such a way that other containers can access them.

Additional information you deem important (e.g. issue happens only occasionally):

Because the release notes stated "This matches better matches Docker's behavior in this case" I've tested the same scenario on a couple of Docker installations. Where it does work with moby-engine in Fedora CoreOS Stable (33.20210426.3.0) and Next (34.20210427.1.0) and with the latest Docker (20.10.6) on an selinux enabled Debian Buster.

In addition I ran the following script to inspect the labels on these installations. In all cases with Docker the directories were relabeled.

#!/bin/bash

echo "relabled volumes"
mkdir private shared
ls -ldZ  private shared
sudo docker run --rm -v "$(pwd)/private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo docker run --rm -v "$(pwd)/shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  private shared
rmdir private shared
echo

echo "relabled volumes (--privileged)"
mkdir privileged-private privileged-shared
ls -ldZ  privileged-private privileged-shared
sudo docker run --rm --privileged -v "$(pwd)/privileged-private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo docker run --rm --privileged -v "$(pwd)/privileged-shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  privileged-private privileged-shared
rmdir privileged-private privileged-shared
echo

echo "relabled volumes (--security-opt label=disable)"
mkdir labeldisable-private labeldisable-shared
ls -ldZ  labeldisable-private labeldisable-shared
sudo docker run --rm --security-opt label=disable -v "$(pwd)/labeldisable-private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo docker run --rm --security-opt label=disable -v "$(pwd)/labeldisable-shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  labeldisable-private labeldisable-shared
rmdir labeldisable-private labeldisable-shared

Output of podman version:

Version:      3.1.2
API Version:  3.1.2
Go Version:   go1.16
Built:        Thu Apr 22 13:11:28 2021
OS/Arch:      linux/amd64

Output of podman info --debug:

host:
  arch: amd64
  buildahVersion: 1.20.1
  cgroupManager: systemd
  cgroupVersion: v1
  conmon:
    package: conmon-2.0.27-2.fc34.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.0.27, commit: '
  cpus: 1
  distribution:
    distribution: fedora
    version: "34"
  eventLogger: journald
  hostname: master-01
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 5.11.15-300.fc34.x86_64
  linkmode: dynamic
  memFree: 141266944
  memTotal: 2072928256
  ociRuntime:
    name: crun
    package: crun-0.19.1-2.fc34.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 0.19.1
      commit: 1535fedf0b83fb898d449f9680000f729ba719f5
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    selinuxEnabled: true
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 0
  swapTotal: 0
  uptime: 7m 12.26s
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 2
    paused: 0
    running: 2
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "true"
  imageStore:
    number: 3
  runRoot: /run/containers/storage
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 3.1.2
  Built: 1619097088
  BuiltTime: Thu Apr 22 13:11:28 2021
  GitCommit: ""
  GoVersion: go1.16
  OsArch: linux/amd64
  Version: 3.1.2

Package info (e.g. output of rpm -q podman or apt list podman):

podman-3.1.2-1.fc34.x86_64

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/master/troubleshooting.md)

Yes

Additional environment details (AWS, VirtualBox, physical, etc.):

Fedora CoreOS Next 34.20210427.1.0 QEMU

The text was updated successfully, but these errors were encountered:

rhatdan · 2021-05-04T19:47:43Z

$ chcon -R -t container_file_t -l s0 ${HOME}/test

But I think that we should do the relabel if the user specifies :z

dustymabe · 2021-05-06T13:25:07Z

But I think that we should do the relabel if the user specifies :z

@rhatdan, so you agree this is a bug that should be fixed?

dghubble · 2021-05-06T16:51:32Z

This does seem surprising. Why should users of privileged containers rewrite this using chcon when this worked before? Seems rather breaking for a v3.1.0 -> v3.1.1 bump.

rhatdan · 2021-05-06T18:38:53Z

This change was made based on others complaining about the break.

dghubble · 2021-05-06T18:49:15Z

Well the relableling has been done for years I think at this point. Is the aim to fix this issue or you think its working as desired?

dustymabe · 2021-05-06T21:39:25Z

Indeed the current behavior is different between docker and podman:

[core@localhost ~]$ bash docker.sh                                                                                                                                       
relabled volumes                                                                                                                                                         
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:26 private                                                                                                                                                                                                                                                                
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:26 shared                                                                                       
drwxr-xr-x. 2 1000 1000 system_u:object_r:container_file_t:s0:c227,c616 6 May  6 21:26 /private                                                                                                                                                                                                                                                    
drwxr-xr-x. 2 1000 1000 system_u:object_r:container_file_t:s0 6 May  6 21:26 /shared                                                                                                                  
drwxr-xr-x. 2 core core system_u:object_r:container_file_t:s0:c227,c616 6 May  6 21:26 private                                                                           
drwxr-xr-x. 2 core core system_u:object_r:container_file_t:s0           6 May  6 21:26 shared                                                                            
                                                                                                                                                                         
relabled volumes (--privileged)                                                                                                                                          
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:26 privileged-private                                                                           
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:26 privileged-shared                                                                            
drwxr-xr-x. 2 1000 1000 system_u:object_r:container_file_t:s0:c210,c541 6 May  6 21:26 /private                                                                          
drwxr-xr-x. 2 1000 1000 system_u:object_r:container_file_t:s0 6 May  6 21:26 /shared                                                                                     
drwxr-xr-x. 2 core core system_u:object_r:container_file_t:s0:c210,c541 6 May  6 21:26 privileged-private                                                                                             
drwxr-xr-x. 2 core core system_u:object_r:container_file_t:s0           6 May  6 21:26 privileged-shared                                                                                              
                                                                                    
relabled volumes (--security-opt label=disable)                                     
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:26 labeldisable-private                                                                                                      
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:26 labeldisable-shared                                                                                                       
drwxr-xr-x. 2 1000 1000 system_u:object_r:container_file_t:s0:c596,c868 6 May  6 21:26 /private                                                                                                       
drwxr-xr-x. 2 1000 1000 system_u:object_r:container_file_t:s0 6 May  6 21:26 /shared                                                                                     
drwxr-xr-x. 2 core core system_u:object_r:container_file_t:s0:c596,c868 6 May  6 21:26 labeldisable-private                                                              
drwxr-xr-x. 2 core core system_u:object_r:container_file_t:s0           6 May  6 21:26 labeldisable-shared                                                                                            
[core@localhost ~]$                                                                 
[core@localhost ~]$                                                                 
[core@localhost ~]$                                                                 
[core@localhost ~]$                                                                 
[core@localhost ~]$                                                                 
[core@localhost ~]$ cp docker.sh podman.sh                                          
[core@localhost ~]$                                                                                                                                                      
[core@localhost ~]$ sudo vi podman.sh                                                                                                                                    
[core@localhost ~]$                                                                                                                                                      
[core@localhost ~]$ sudo podman pull registry.fedoraproject.org/fedora-minimal:33                                                                                        
Trying to pull registry.fedoraproject.org/fedora-minimal:33...                                                                                                           
Getting image source signatures                                                                                                                                          
Copying blob c910ca56c96c done                                                                                                                                           
Copying config 3b3ad91173 done                                                                                                                                           
Writing manifest to image destination                                               
Storing signatures                                                                  
3b3ad91173ca95d0a4715866be3ac13dbe186a8d63908ef86a2e782cdef2913d                                                                                                         
[core@localhost ~]$                                                                                                                                                      
[core@localhost ~]$ bash podman.sh                                                                                                                                       
relabled volumes                                                                                                                                                         
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 private                                                                                      
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 shared                                                                                       
drwxr-xr-x. 2 1000 1000 system_u:object_r:container_file_t:s0:c571,c776 6 May  6 21:27 /private                                                                          
drwxr-xr-x. 2 1000 1000 system_u:object_r:container_file_t:s0 6 May  6 21:27 /shared                                                                                     
drwxr-xr-x. 2 core core system_u:object_r:container_file_t:s0:c571,c776 6 May  6 21:27 private                                                                           
drwxr-xr-x. 2 core core system_u:object_r:container_file_t:s0           6 May  6 21:27 shared                                                                            
                                                                                                                                                                                                                                                                                                                                                                                                            
relabled volumes (--privileged)                                                                                                                                          
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 privileged-private                                                                           
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 privileged-shared                                                                                                                                                                                                                                                      
drwxr-xr-x. 2 1000 1000 unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 /private                                                                                                                  
drwxr-xr-x. 2 1000 1000 unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 /shared                                                                                      
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 privileged-private                                                                           
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 privileged-shared                                                                                                         
                                                                                    
relabled volumes (--security-opt label=disable)                                     
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 labeldisable-private                                                                                                      
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 labeldisable-shared                                                                                                       
drwxr-xr-x. 2 1000 1000 unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 /private                                                                                                                  
drwxr-xr-x. 2 1000 1000 unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 /shared                                                                                                                   
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 labeldisable-private                                                                         
drwxr-xr-x. 2 core core unconfined_u:object_r:user_home_t:s0 6 May  6 21:27 labeldisable-shared                                                                          
[core@localhost ~]$                                                                 
[core@localhost ~]$                                                                 
[core@localhost ~]$ sudo docker -v                                                  
Docker version 20.10.6, build 370c289

[core@localhost ~]$ cat docker.sh 
#!/bin/bash

echo "relabled volumes"
mkdir private shared
ls -ldZ  private shared
sudo docker run --rm -v "$(pwd)/private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo docker run --rm -v "$(pwd)/shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  private shared
rmdir private shared
echo

echo "relabled volumes (--privileged)"
mkdir privileged-private privileged-shared
ls -ldZ  privileged-private privileged-shared
sudo docker run --rm --privileged -v "$(pwd)/privileged-private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo docker run --rm --privileged -v "$(pwd)/privileged-shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  privileged-private privileged-shared
rmdir privileged-private privileged-shared
echo

echo "relabled volumes (--security-opt label=disable)"
mkdir labeldisable-private labeldisable-shared
ls -ldZ  labeldisable-private labeldisable-shared
sudo docker run --rm --security-opt label=disable -v "$(pwd)/labeldisable-private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo docker run --rm --security-opt label=disable -v "$(pwd)/labeldisable-shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  labeldisable-private labeldisable-shared
rmdir labeldisable-private labeldisable-shared
[core@localhost ~]$ 
[core@localhost ~]$ 
[core@localhost ~]$ 
[core@localhost ~]$ 
[core@localhost ~]$ 
[core@localhost ~]$ 
[core@localhost ~]$ cat podman.sh 
#!/bin/bash

echo "relabled volumes"
mkdir private shared
ls -ldZ  private shared
sudo podman run --rm -v "$(pwd)/private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo podman run --rm -v "$(pwd)/shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  private shared
rmdir private shared
echo

echo "relabled volumes (--privileged)"
mkdir privileged-private privileged-shared
ls -ldZ  privileged-private privileged-shared
sudo podman run --rm --privileged -v "$(pwd)/privileged-private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo podman run --rm --privileged -v "$(pwd)/privileged-shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  privileged-private privileged-shared
rmdir privileged-private privileged-shared
echo

echo "relabled volumes (--security-opt label=disable)"
mkdir labeldisable-private labeldisable-shared
ls -ldZ  labeldisable-private labeldisable-shared
sudo podman run --rm --security-opt label=disable -v "$(pwd)/labeldisable-private:/private:Z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /private
sudo podman run --rm --security-opt label=disable -v "$(pwd)/labeldisable-shared:/shared:z" registry.fedoraproject.org/fedora-minimal:33 ls -ldZ /shared
ls -ldZ  labeldisable-private labeldisable-shared
rmdir labeldisable-private labeldisable-shared

dustymabe · 2021-05-07T19:01:09Z

Fixed in #10253

openshift-ci-robot added the kind/bug Categorizes issue or PR as related to a bug. label May 4, 2021

basvdlei mentioned this issue May 6, 2021

Mounts permission denied starting in 33.20210426.3.0 coreos/fedora-coreos-tracker#818

Closed

rhatdan mentioned this issue May 6, 2021

Revert Patch to relabel if selinux not enabled #10253

Merged

dustymabe closed this as completed May 7, 2021

This was referenced May 12, 2021

testing: new release on 2021-05-13 (34.20210427.2.1) coreos/fedora-coreos-streams#310

Closed

next: new release on 2021-05-13 (34.20210503.1.1) coreos/fedora-coreos-streams#311

Closed

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 22, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 22, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Privileged container volumes are not relabeled #10209

Privileged container volumes are not relabeled #10209

basvdlei commented May 4, 2021 •

edited

Loading

rhatdan commented May 4, 2021

dustymabe commented May 6, 2021

dghubble commented May 6, 2021

rhatdan commented May 6, 2021

dghubble commented May 6, 2021

dustymabe commented May 6, 2021

dustymabe commented May 7, 2021

Privileged container volumes are not relabeled #10209

Privileged container volumes are not relabeled #10209

Comments

basvdlei commented May 4, 2021 • edited Loading

rhatdan commented May 4, 2021

dustymabe commented May 6, 2021

dghubble commented May 6, 2021

rhatdan commented May 6, 2021

dghubble commented May 6, 2021

dustymabe commented May 6, 2021

dustymabe commented May 7, 2021

basvdlei commented May 4, 2021 •

edited

Loading