8

I have a program running inside a Docker container that loads an .so file which alters the behaviour of the program through hooking and memory manipulation. This behaviour is blocked by SELinux with the following message in the audit log:

type=AVC msg=audit(1548166862.066:2419): avc: denied { execheap } for pid=11171 comm="myProgram" scontext=system_u:system_r:container_t:s0:c426,c629 tcontext=system_u:system_r:container_t:s0:c426,c629 tclass=process permissive=0

I am extremely hesistant to just run this through audit2allow as I do not want to allow this specific behaviour anywhere else (as that would be quite risky).

  • How can I tell SELinux to allow this specific behaviour in the safest manner possible?
  • Can I do this in a way that allows me to spawn more Docker containers running the same program in the future?
4
+100

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example container_execheap:

    policy_module(container_execheap, 1.0)
    
    virt_sandbox_domain_template(container_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (necessary development files, including the makefile, should be provided by selinux-policy-devel package):

    make -f /usr/selinux/devel/Makefile container_execheap.pp
    semodule -i container_execheap.pp
    

    The new type can be configured to be a permissive domain:

    semanage permissive -a container_execheap_t
    

    For permissive domains, AVC denials are logged but rules are not enforced. This way it is easy to generate the missing rules later using audit2allow.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:container_execheap_t ...

  4. Generate expected errors. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (remember to bump up version number) with the new rules. Compile and install the updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d container_execheap.

  • Your answer seems to be the way to go -- unfortunately though I don't have any experience creating SELinux policies myself. This is what I've come up with by looking through the blog post you linked to and other documentation. I have a feeling I'm not doing it right... could you perhaps help me by pointing me in the right direction? Does my policy make any sense at all? – Thomas Jan 22 at 22:20
  • Thanks, I now have something that appears to work! This is what I ended up with. I did however receive a bunch of errors regarding duplicates during compile time, I'm assuming that's a problem in the included policies rather than my own? I'm also not quite sure why the string inside the gen_require statement must be terminated with a ' instead of a ` (the latter threw an error). Anyway, thanks again for the help! – Thomas Jan 23 at 13:25
  • I think it is safe to ignore those specific errors, see bugzilla. Quoting using `' is how it works in M4 language, which is used to write reference policy modules. You can check (using ps axZ etc.) that your container runs in the correct context if you want to double-check after installing and configuring your custom policy. – sebasth Jan 25 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.