On a currently running system that heavily is using docker containers, I noticed that running the daemon with
selinux-enforcing:true, I obtained an (previously unseen) error message in my audit log.
type=SELINUX_ERR msg=audit(1563196721.604:176781): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:container_runtime_t:s0 newcontext=system_u:system_r:spc_t:s0
So, although this wasn't surprising, it was odd because I did not see any accompanying AVC logs.
- What does it mean if you see an SELINUX_ERR with a
seresult=deniedfield in it, which doesn't have an AVC ?
- Related to the question above, more generally, should every selinux denial or error event result in exactly one AVC log ?
My hypotheses for possible explanation of why an selnux_err denial message might be missing an avc log:
- Selinux denied an action because of an internal error, thus no AVC log was possible because it wasn't a 'fully' sensible security denial.
- The audit log isn't capable of generating enough info to give you a valid AVC line, so it stays silent.
- Some kind of log rotation of selinux has rotated the error out, and so its thus just been deleted from recent history, but it was in fact there at one time.
- The interpretation of "seresult=denied" is incorrect in this question, and true selinux denials are always accompanied with avc logs.