Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1375124

Summary: SELinux cause the dhclient failed in the new net namespace
Product: [Fedora] Fedora Reporter: Xibo Ning <xning>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 24CC: dominick.grift, dwalsh, lvrabec, mgrepl, plautrba
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-3.13.1-191.16.fc24 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-22 00:22:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Xibo Ning 2016-09-12 08:32:24 UTC
Description of problem:
When creating a new namespace, and add an interface to it, then dhcp in the new namespaces dhclient cli, the cli will fail.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Create an interface, e.g. a macvtap device, and a new namespaces including a new net namespaces.
2. Add the interface to the new namespaces
3. Up and dhcp the interface in the new namespaces

Actual results:
dhcp failed and the interface has not any IP addr.

Expected results:
The interface gets an IP addr, broadcast addr, ..., etc.

Additional info:

SELinux is preventing dhclient from net_bind_service access on the cap_userns Unknown.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that dhclient should be allowed net_bind_service access on the Unknown cap_userns by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'dhclient' --raw | audit2allow -M my-dhclient
# semodule -X 300 -i my-dhclient.pp

Additional Information:
Source Context                unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023
Target Context                unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023
Target Objects                Unknown [ cap_userns ]
Source                        dhclient
Source Path                   dhclient
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-191.14.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux localhost 4.7.2-201.fc24.x86_64 #1 SMP Fri
                              Aug 26 15:58:40 UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-09-12 16:11:22 CST
Last Seen                     2016-09-12 16:11:22 CST
Local ID                      ee534592-100b-47a8-9513-18bf8fd5ec69

Raw Audit Messages
type=AVC msg=audit(1473667882.131:215): avc:  denied  { net_bind_service } for  pid=2366 comm="dhclient" capability=10  scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tclass=cap_userns permissive=0


Hash: dhclient,dhcpc_t,dhcpc_t,cap_userns,net_bind_service

Comment 1 Fedora Update System 2016-09-15 17:23:48 UTC
selinux-policy-3.13.1-191.16.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-fe39b806b6

Comment 2 Fedora Update System 2016-09-16 00:51:49 UTC
selinux-policy-3.13.1-191.16.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fe39b806b6

Comment 3 Fedora Update System 2016-09-22 00:22:25 UTC
selinux-policy-3.13.1-191.16.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.