SELinux issues with podman and Quadlet?

[mcdent]

I'm seeing some issues in the journal, as I switch my podman containers over to the new Quadlet unit files.
Here is an example of what I am seeing, I switched 'smokeping' container over and it appears that the output graph files are not being created.

un 22 13:50:39 docker1 setroubleshoot[78363]: SELinux is preventing /usr/bin/coreutils from setattr access on the directory /home/mike/docker/smokeping/config. For complete SELinux messages run: sealert -l 951cd06e-eb05-4c80-b87a-2288e074287d
Jun 22 13:50:39 docker1 setroubleshoot[78363]: SELinux is preventing /usr/bin/coreutils from setattr access on the directory /home/mike/docker/smokeping/config.

                                               *****  Plugin catchall (100. confidence) suggests   **************************

                                               If you believe that coreutils should be allowed setattr access on the config directory by default.
                                               Then you should report this as a bug.
                                               You can generate a local policy module to allow this access.
                                               Do
                                               allow this access for now by executing:
                                               # ausearch -c 'chown' --raw | audit2allow -M my-chown
                                               # semodule -X 300 -i my-chown.pp

Jun 22 13:50:39 docker1 setroubleshoot[78363]: failed to retrieve rpm info for path '/home/mike/docker/smokeping/config/site-confs/smokeping.conf':
Jun 22 13:50:39 docker1 setroubleshoot[78363]: SELinux is preventing /usr/bin/coreutils from setattr access on the file /home/mike/docker/smokeping/config/site-confs/smokeping.conf. For complete SELinux messages run: sealert -l 8e8e0d3a-8302-4a88-8f75-03d3c664b7f6
Jun 22 13:50:39 docker1 setroubleshoot[78363]: SELinux is preventing /usr/bin/coreutils from setattr access on the file /home/mike/docker/smokeping/config/site-confs/smokeping.conf.

                                               *****  Plugin catchall (100. confidence) suggests   **************************

                                               If you believe that coreutils should be allowed setattr access on the smokeping.conf file by default.
                                               Then you should report this as a bug.
                                               You can generate a local policy module to allow this access.
                                               Do
                                               allow this access for now by executing:
                                               # ausearch -c 'chown' --raw | audit2allow -M my-chown
                                               # semodule -X 300 -i my-chown.pp

un 22 13:55:48 docker1 setroubleshoot[79266]: SELinux is preventing /usr/bin/perl from add_name access on the directory /run/s6/legacy-services/smokeping/(null). For complete SELinux messages run: sealert -l cb56a067-1d4a-44af-9445-e4429b0d446b
Jun 22 13:55:48 docker1 setroubleshoot[79266]: SELinux is preventing /usr/bin/perl from add_name access on the directory /run/s6/legacy-services/smokeping/(null).

                                               *****  Plugin restorecon (99.5 confidence) suggests   ************************

                                               If you want to fix the label.
                                               /run/s6/legacy-services/smokeping/(null) default label should be var_run_t.
                                               Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.
                                               Do
                                               # /sbin/restorecon -v /run/s6/legacy-services/smokeping/(null)

                                               *****  Plugin catchall (1.49 confidence) suggests   **************************

                                               If you believe that perl should be allowed add_name access on the (null) directory by default.
                                               Then you should report this as a bug.
                                               You can generate a local policy module to allow this access.
                                               Do
                                               allow this access for now by executing:
                                               # ausearch -c '/usr/bin/smokep' --raw | audit2allow -M my-usrbinsmokep
                                               # semodule -X 300 -i my-usrbinsmokep.pp

Jun 22 13:55:48 docker1 setroubleshoot[79266]: SELinux is preventing /usr/bin/perl from create access on the file /run/s6/legacy-services/smokeping/(null). For complete SELinux messages run: sealert -l 27263f92-ffb4-4137-a9c9-1e9381e19b09
Jun 22 13:55:48 docker1 setroubleshoot[79266]: SELinux is preventing /usr/bin/perl from create access on the file /run/s6/legacy-services/smokeping/(null).

                                               *****  Plugin restorecon (99.5 confidence) suggests   ************************

                                               If you want to fix the label.
                                               /run/s6/legacy-services/smokeping/(null) default label should be var_run_t.
                                               Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.
                                               Do
                                               # /sbin/restorecon -v /run/s6/legacy-services/smokeping/(null)

                                               *****  Plugin catchall (1.49 confidence) suggests   **************************

                                               If you believe that perl should be allowed create access on the (null) file by default.
                                               Then you should report this as a bug.
                                               You can generate a local policy module to allow this access.
                                               Do
                                               allow this access for now by executing:
                                               # ausearch -c '/usr/bin/smokep' --raw | audit2allow -M my-usrbinsmokep
                                               # semodule -X 300 -i my-usrbinsmokep.pp

Jun 22 13:55:48 docker1 setroubleshoot[79266]: SELinux is preventing /usr/bin/perl from ioctl access on the file /data/__sortercache/new.FPing. For complete SELinux messages run: sealert -l 6898a215-013c-4cbc-91f3-606088050d03
Jun 22 13:55:48 docker1 setroubleshoot[79266]: SELinux is preventing /usr/bin/perl from ioctl access on the file /data/__sortercache/new.FPing.

                                               *****  Plugin restorecon (99.5 confidence) suggests   ************************

                                               If you want to fix the label.
                                               /data/__sortercache/new.FPing default label should be default_t.
                                               Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.

I shan't bore you with the rest. I don't recall seeing these errors previous to this?

Thanks
Mike

[rhatdan]

Can you attach the actual AVCs

sudo ausearch -m avc

[mcdent]

avc.txt

Thanks

[rhatdan]

This looks like you are either volume mounting in content from your homedir into the container without a 🇿🇲Z.

Or content in your homedir is not labeled correctly.

Could you run

$ restorecon -R -v $HOME/.local/share/containers

By any chance did containers-selinux blow up during an installation.

$ sudo dnf -y reinstall container-selinux

Is your homedir in a different location then default?

[mcdent]

Thanks for your reply. Sorry what am I not using to mount? (I see flag Z) For some reason the character is being represented as a flag on GitHub, at least in my web browser/email client ?
Mike

[rhatdan]

If you just run a container as the user with the quadlet does it work?

Please attach the quadlet file to this discusion.

[mcdent]

Hi,
well I managed to get things working. Mainly it turned out that after I moved the container over to Quadlet, I noticed that fping inside the container did not have permission to run. I added

AddCapability=NET_RAW
AddCapability=NET_ADMIN

to my quadlet file and all is well. Here is the file, just in case you spot anything incorrect. I'd like to move my remaining containers over as smoothly as possible :)

[Unit]
Description=Smoke Ping
After=local-fs.target

[Container]
Image=lscr.io/linuxserver/smokeping:latest
Volume=/home/mike/docker/smokeping/config:/config
Volume=/home/mike/docker/smokeping/data:/data
PublishPort=8585:80
PodmanArgs=--dns=192.168.1.1
Environment=TZ=Europe/London
AddCapability=NET_RAW
AddCapability=NET_ADMIN
ContainerName=smokeping
Label="io.containers.autoupdate=registry"
Exec=

[Install]
# Start by default on boot
WantedBy=multi-user.target default.target

Everyday is a learning day! So they say

[rhatdan]

Are you sure you needed NET_ADMIN?
You can allow a non root users to ping by setting default_syscls in containers.conf.

# A list of sysctls to be set in containers by default,
# specified as "name=value",
# for example:"net.ipv4.ping_group_range=0 0".
#
default_sysctls = [
  "net.ipv4.ping_group_range=0 0",
]

[mcdent]

Are you sure you needed NET_ADMIN? You can allow a non root users to ping by setting default_syscls in containers.conf.

# A list of sysctls to be set in containers by default,
# specified as "name=value",
# for example:"net.ipv4.ping_group_range=0 0".
#
default_sysctls = [
  "net.ipv4.ping_group_range=0 0",
]

Thank, I have removed NET_ADMIN and this still works.

[mcdent]

Thanks, that was already set in containers.conf however I notice a few other options I could likely put in there, such as DNS etc.
Thanks for the tip.