error building master branch on rhel 7.3

[containers]

error building master branch on rhel 7.3

[lsm5]

@rhatdan @wrabcak I don't see fs_rw_nsfs_files defined anywhere /usr/share/selinux/devel/include with selinux-policy-3.13.1-93.el7.noarch. Is that the right reason for this issue?

[rhatdan]

Yes we need an updated version of selinux-policy with that interface, or we need to carry it ourselves.

[rhatdan]

@wrabcak Could you fix this?

[lsm5]

@rhatdan is this something I could just include in docker.if or another interface file in docker-selinux ? Might be a much quicker fix than spinning up a new selinux-policy?

[lsm5]

@rhatdan @wrabcak I added lsm5@e543d2e and now it's erroring out syntax error at token 'virt_stub_svirt_sandbox_file'. Seems like I don't hit the original issue anymore, so let me know if it's ok to proceed.

[ssekidde]

@lsm5 that stub interface is missing as well in RHEL7 and needs to be added.

[lsm5]

@ssekidde hi, RE: nsfs I just copied that over from tracefs that I found in kernel/filsystems.if, but not sure how to proceed with stub interface. Could you please add them both in selinux-policy and update the rpm, docker 7.3 builds are blocked on this currently

[ssekidde]

@lsm5 both interfaces will have to be added by @wrabcak in selinux-policy. Does a BZ exist?
For testing purposes see if you can try to add this to docker.if

interface(virt_stub_svirt_sandbox_file',
gen_require(`
type svirt_sandbox_file_t;
')
')

[lsm5]

On Thu, Sep 01, 2016 at 11:59:07AM -0700, Simon Sekidde wrote:

@lsm5 both interfaces will have to be added by @wrabcak in selinux-policy. Does a BZ exist?
For testing purposes see if you can try to add this to docker.if

########################################

svirt_sandbox_file_t stub interface. No access allowed.

Domain allowed access.

interface(virt_stub_svirt_sandbox_file',
gen_require(`
type svirt_sandbox_file_t;
')
')

Dan added a temporary fix for this in docker-selinux itself. I'll file a bz
for selinux-policy.

Lokesh
Freenode: lsm5
GPG: 0xC7C3A0DD

[rhatdan]

Yes we can just hack the docker.te until we have these interfaces in the selinux-policy package.

[wrabcak]

Sorry for delay. Problem here is quite bigger. We don't have labeling for nsfs filesystem in rhel-7.3. @lsm5 could you create BZ to add this interface to selinux-policy on rhel-7.3 ? I assume this is blocker for you guys.
Thanks.

[rhatdan]

@wrabcak We worked around it by embedding the code into docker.te. We actually need to interfaces to remove this hack.
45be230

[lsm5]

@wrabcak https://bugzilla.redhat.com/show_bug.cgi?id=1372705

[rhatdan]

Fixed in current release.