container_use_samba boolean

[containers]

container_use_samba boolean

[rhatdan]

We virt_use_samba already works.

[jcwebservices]

It's mounted as samba_share_t with fcontext.

[jcastillo2nd@helm ~]$ stat /opt/share/
  File: '/opt/share/'
  Size: 4096            Blocks: 8          IO Block: 4096   directory
Device: fd01h/64769d    Inode: 2           Links: 27
Access: (0755/drwxr-xr-x)  Uid: ( 1000/jcastillo2nd)   Gid: ( 1000/jcastillo2nd)
Context: system_u:object_r:samba_share_t:s0
Access: 2017-02-01 17:44:16.102088526 +0000
Modify: 2017-02-01 11:21:46.796247164 +0000
Change: 2017-02-01 17:44:16.101088502 +0000
 Birth: -

Make sure we go the bool going:

[jcastillo2nd@helm Dockerfiles]$ sudo semanage boolean --list | grep virt_use_samba
virt_use_samba                 (on   ,   on)  Allow virt to use samba

Going to start up the container:

[jcastillo2nd@helm Dockerfiles]$ sudo docker run -d -v /opt/share:/opt/share -ti fedora:25 bash
ff8d832b218f6b0b89dcb3ee68b13f30d9c33c07a672de4eca3dabaae6646c09

Quick verification of processes:

system_u:system_r:container_runtime_t:s0 root 697 0.0  0.1 289256 8272 ?       Ssl  19:07   0:00 /usr/libexec/docker/docker-containerd-current --listen unix:///run/containerd.sock --shim /usr/libexec/docker/docker-containerd-shim-current --start-timeout 2m
system_u:system_r:container_runtime_t:s0 root 1111 0.0  0.0 124672 2736 ?      Sl   19:10   0:00  \_ /usr/libexec/docker/docker-containerd-shim-current ff8d832b218f6b0b89dcb3ee68b13f30d9c33c07a672de4eca3dabaae6646c09 /var/run/docker/libcontainerd/ff8d832b218f6b0b89dcb3ee68b13f30d9c33c07a672de4eca3dabaae6646c09 /usr/libexec/docker/docker-runc-current
system_u:system_r:container_t:s0:c246,c510 root 1125 0.0  0.0 12584 3568 pts/1 Ss+  19:10   0:00      \_ bash

With a tail of audit.log going for denies, try to touch a file.

[jcastillo2nd@helm Dockerfiles]$ sudo docker attach ff8d
^C
[root@ff8d832b218f /]# touch /opt/share/test
touch: cannot touch '/opt/share/test': Permission denied
[root@ff8d832b218f /]# ls -l /opt/share/
ls: cannot open directory '/opt/share/': Permission denied

And this is what I'm seeing in the audit log tail:

[jcastillo2nd@helm ~]$ sudo tail -n 0 -f /var/log/audit/audit.log | grep denied
type=AVC msg=audit(1485976511.058:287): avc:  denied  { write } for  pid=1438 comm="touch" name="/" dev="dm-1" ino=2 scontext=system_u:system_r:container_t:s0:c246,c510 tcontext=system_u:object_r:samba_share_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1485976525.519:289): avc:  denied  { read } for  pid=1440 comm="ls" name="/" dev="dm-1" ino=2 scontext=system_u:system_r:container_t:s0:c246,c510 tcontext=system_u:object_r:samba_share_t:s0 tclass=dir permissive=0

I am pretty sure that virt_use_samba is not working for the container policies here, or am I mistaken on something here?

[jcastillo2nd@helm Dockerfiles]$ sudo dnf info selinux-policy
Last metadata expiration check: 2:35:14 ago on Wed Feb  1 16:45:48 2017.
Installed Packages
Name        : selinux-policy
Arch        : noarch
Epoch       : 0
Version     : 3.13.1
Release     : 225.6.fc25
Size        : 20 k
Repo        : @System
From repo   : updates
Summary     : SELinux policy configuration
URL         : http://github.com/TresysTechnology/refpolicy/wiki
License     : GPLv2+
Description : SELinux Base package for SELinux Reference Policy - modular.
            : Based off of reference policy: Checked out revision  2.20091117

[rhatdan]

samba_share_t is local storage being shared with others via samba. Remove samba/windows file systems being shared into a container would be cifs_t. Which would be allowed with this boolean.

Are you trying to put samba into a container to share it elsewhere?

[jcwebservices]

I'll switch over the context to cifs_t for that and test further. I'm mapping a volume for a docker container that is provided through a cifs mount and shared through samba with non linux systems on the network. If samba can read/write to cifs_t and container can read/write to cifs_t ( provided the permissions/ownership are all good ) that should resolve the issue.

[rhatdan]

No that will not work either. If you want a share that can be read by both then use :Z for the volume mount into the container and then set a boolean for samba to share all content.
samba_export_all_ro
or
samba_export_all_r2

[jcwebservices]

Thanks for the info. That indeed does work out.