5

Sharing a host directory with a docker container usually is easy enough:

$ docker create -v /path/to/hostdir:/path/inside/container --name conta ...

Things get more complicated, if SELinux is involved - e.g. an SELinux enforcing Fedora 23 container on an SELinux enforcing docker host (also Fedora 23).

In that case, apparently, one has to instruct docker to do some relabeling:

$ docker create -v /path/to/hostdir:/path/inside/container:Z --name conta ...

Without the :Z suffix you get permission denied errors when trying to read/write files in the shared host directory. With :Z everything works as expected.

But the :Z approach fails if the host directory should be shared with multiple (SELinux enforcing) containers at the same time:

$ docker create -v /path/to/hostdir:/path/inside/container:Z --name conta ...
$ docker create -v /path/to/hostdir:/path/inside/container:Z --name contb ...

After the 2nd command, 'contb' can access the host directory, but 'conta' can't access it any more (permission denied errors).

It seems that the 2nd relabeling by docker invalidates the first.

How to fix this on a SELinux system?

3

Not sure if it will help, since I am not playing with docker right now, but I have got quite close to these technologies.

There is nice article from Dan Walsh describing difference between :Z and :z in the docker commands.

TL;DR, the first (:Z) is using Multi-Category Security (MCS) labels, which will make the same labels with different distinct categories for different containers.

The second one (:z) will label the directory with same labels for every container and they should be able to access the path simultaneously.

If it will not help, please provide the AVCs you are getting from the docker. Otherwise it is like guessing.

  • Yes, the MCS labels are the issue here - I've just done some experiments: with :z the sharing between multiple containers works because after both create statements the directory is labeled with system_u:object_r:svirt_sandbox_file_t:s0. With :Z, the directory has system_u:object_r:svirt_sandbox_file_t:s0:c39,c367 after the first create and system_u:object_r:svirt_sandbox_file_t:s0:c556,c645 after the second. Thus, the first container gets permission denied because of the mismatching MCS label. Thus, for this use case, :z is the way to go. – maxschlepzig Mar 20 '16 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.