 |
this can also be reproduced trying to start the (root) podman socket from cockpit. cockpit also shows the following SELinux errors: SELinux is preventing /usr/bin/podman from create access on the directory net.d. type=AVC msg=audit(1659117378.738:143): avc: denied { create } for pid=1533 comm="podman" name="net.d" scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 type=SYSCALL msg=audit(1659117378.738:143): arch=c000003e syscall=258 success=no exit=-13 a0=ffffffffffffff9c a1=c00098f830 a2=1c0 a3=7ffde8f23080 items=0 ppid=1 pid=1533 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="podman" exe="/usr/bin/podman" subj=system_u:system_r:container_runtime_t:s0 key=(null) SELinux is preventing /usr/bin/podman from read access on the directory journal. type=AVC msg=audit(1659117379.226:176): avc: denied { read } for pid=1608 comm="podman" name="journal" dev="tmpfs" ino=62 scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:object_r:syslogd_var_run_t:s0 tclass=dir permissive=0 type=SYSCALL msg=audit(1659117379.226:176): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=c000048570 a2=80000 a3=0 items=0 ppid=1 pid=1608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="podman" exe="/usr/bin/podman" subj=system_u:system_r:container_runtime_t:s0 key=(null) SELinux is preventing /usr/bin/podman from quotamod access on the filesystem . type=AVC msg=audit(1659117379.251:177): avc: denied { quotamod } for pid=1608 comm="podman" scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0 type=SYSCALL msg=audit(1659117379.251:177): arch=c000003e syscall=179 success=no exit=-13 a0=580402 a1=7f0cdc000b90 a2=a1507877 a3=c00083dff8 items=0 ppid=1 pid=1608 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="podman" exe="/usr/bin/podman" subj=system_u:system_r:container_runtime_t:s0 key=(null) this breaks the functionality of cockpit from managing root containers |
 |
This will be addressed in an upcoming update: container-selinux-2.179.1-1.el9_0.0.1.noarch Mirrors will have this package likely over the weekend. |
- Anonymous
