On a currently running system that heavily is using docker containers, I noticed that running the daemon with selinux-enforcing:true, I obtained an (previously unseen) error message in my audit log.

type=SELINUX_ERR msg=audit(1563196721.604:176781): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:container_runtime_t:s0 newcontext=system_u:system_r:spc_t:s0

So, although this wasn't surprising, it was odd because I did not see any accompanying AVC logs.

  • What does it mean if you see an SELINUX_ERR with a seresult=denied field in it, which doesn't have an AVC ?
  • Related to the question above, more generally, should every selinux denial or error event result in exactly one AVC log ?

My hypotheses for possible explanation of why an selnux_err denial message might be missing an avc log:

  • Selinux denied an action because of an internal error, thus no AVC log was possible because it wasn't a 'fully' sensible security denial.
  • The audit log isn't capable of generating enough info to give you a valid AVC line, so it stays silent.
  • Some kind of log rotation of selinux has rotated the error out, and so its thus just been deleted from recent history, but it was in fact there at one time.
  • The interpretation of "seresult=denied" is incorrect in this question, and true selinux denials are always accompanied with avc logs.
  • I'm leaning towards the final bullet (maybe I've misinterpretted the meaning of the SELINUX_ERR log message) at the time of writing of this question. – jayunit100 Jul 15 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.