Relabling blocked when using NoNewPrivileges

[containers]

Relabling blocked when using NoNewPrivileges

[rhatdan]

I am working on typebounds on Fedora right now, I will back port fixes for RHEL

[wrabcak]

@rhatdan, We need to test this on Fedora. SELinux team added support for NoNewPrivileges + SELinux so we fix this by nnp_transition type.

[rhatdan]

@cpuguy83 You are doing this with a SPC_t container, which means that you are either compiling the docker without selinux support or you are running without --selinux-enabled in the docker daemon.

[cpuguy83]

@rhatdan I'm specifying this through crictl against cri-containerd, spc_t was just an example. svirt_lxc_net_t also fails in the same way... just happen to be using docker-runc as a final test to make sure I didn't mislabel the 'proper' runc.

[rhatdan]

Ok you are doing this on a RHEL or Centos system?

[cpuguy83]

Adding the custom typebounds rule shown in your blog works

Ok you are doing this on a RHEL or Centos system?

CentOS

[rhatdan]

Ok it turns out that there are some big fixes for SELinux policy coming in RHEL7.5 which will make this a lot easier to handle. I just updated container-selinux for Fedora 27 and Rawhide, to use the new nnp_transition feature. But for now this is broken on Centos and RHEL. You can add the typebounds to make it work.

[cpuguy83]

Thanks, Dan!
What are the implications of adding the necessary typebounds rules?

[rhatdan]

@cpuguy83 There is not security issue with adding them. They basically just allow the transition, so that you are allowed to run spc_t or svirt_lxc_net_t (container_t) on your system. I will update the next container-selinux for RHEL with the type bounds allowed, and see if it compiles correctly.

[rhatdan]

This is now fixed in Fedora and should be fixed in the next container-selinux update in RHEL.

[cpuguy83]

Thanks!