AVC denied for docker while trying to set labels for tmpfs mounts

Sujithra P sujithrap at gmail.com
Wed Jul 21 18:46:23 UTC 2021

Hi SELinux Experts,

The following issue is described in the below post as well.

Occasionally running into the following selinux denials for docker

type=AVC msg=audit(1626732057.636:4583): avc:  denied  { associate }
for  pid=57450 comm="dockerd" name="/" dev="tmpfs" ino=150014
tcontext=system_u:object_r:lib_t:s0 tclass=filesystem permissive=0

type=AVC msg=audit(1626812823.170:9434): avc:  denied  { associate }
for  pid=20027 comm="dockerd" name="/" dev="tmpfs" ino=198147
tcontext=system_u:object_r:locale_t:s0 tclass=filesystem permissive=0

 level=error msg="Handler for POST
returned error: error setting label on mount source
failed to set file label on
permission denied"

Docker is not able to set labels for these tmpfs mounts because they
end up having wrong labels when they are created (sometimes
"locale_t", sometimes "lib_t" which of course is not the
default/correct context for tmpfs fs).
Apparently semodule -R and deleting these tmps files or reboot of the
node fixes the problem.
Not sure what is causing the tmpfs mounts to get wrong labels in the
first place.

Everything seems to be fine to begin with, but as the system keeps
scheduling pods on the node, this behavior is observed sometimes (not
consistent always).

OS Details:

NAME="CentOS Linux"
VERSION="8 (Core)"
ID_LIKE="rhel fedora"
PRETTY_NAME="CentOS Linux 8 (Core)"

Docker Version:
Client: Docker Engine - Community
Version: 19.03.13
API version: 1.40
Go version: go1.13.15
Git commit: 4484c46d9d
Built: Wed Sep 16 17:02:36 2020
OS/Arch: linux/amd64
Experimental: false

Kubernetes Version*

Any help on how to debug this issue  would be greatly appreciated.


More information about the Linux-security-module-archive mailing list