Swift service tries to relabel files

[Cédric Jeanneret]

Hello,

Swift service wants to relabel files in its container. This is prohibited in a selinux-enabled system with proper separation, and raises the following AVCs:

type=AVC msg=audit(1552310439.450:533): avc: denied { relabelto } for pid=27235 comm="cp" name="account.ring.gz" dev="vda1" ino=4713480 scontext=system_u:system_r:container_t:s0:c18,c213 tcontext=unconfined_u:object_r:container_file_t:s0 tclass=file permissive=1
type=AVC msg=audit(1552310439.451:534): avc: denied { relabelto } for pid=27235 comm="cp" name="backups" dev="vda1" ino=4713486 scontext=system_u:system_r:container_t:s0:c18,c213 tcontext=unconfined_u:object_r:container_file_t:s0 tclass=dir permissive=1

This might comes from a "cp -a" call, as that one will try (and fail) to reapply the SELinux labels.

Note: we will never allow relabelto from within a container, since it can lead to a major security hole on the host system.

Cheers,

C.

[Michele Baldessari (michele)]

Thanks Cedric. So I think this is the snippet that barfs on us:
          swift_copy_rings:
            image: *swift_ringbuilder_image
            net: none
            user: root
            detach: false
            command:
              # Use bash to run the cp command so that wildcards can be used
              - '/bin/bash'
              - '-c'
              - 'cp -v -a -t /etc/swift /swift_ringbuilder/etc/swift/*.gz /swift_ringbuilder/etc/swift/*.builder /swift_ringbuilder/etc/swift/backups'

This is from deployment/swift/swift-ringbuilder-container-puppet.yaml

Can we work around this by adding a specific --context[=CTX] param to the cp call?

[Cédric Jeanneret (cjeanner)]

Thanks Michele!
That's exactly the thing :).

We might want to either:
- replace "-a" by its plain option with some salt and pepper
- just add, after "-a", --no-preserve=context

Lemme try the latter first.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/643240
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=c55cf61c99a8ad5e743672d1ef56fa12dbdc5f17
Submitter: Zuul
Branch: master

commit c55cf61c99a8ad5e743672d1ef56fa12dbdc5f17
Author: Cédric Jeanneret <email address hidden>
Date: Thu Mar 14 08:45:14 2019 +0100

    Avoid "-a" cp option in order to avoid SELinux AVC

    Using "cp -a" in a container might lead to SELinux failures, since this option
    is a shortcut for "-dR --preserve=all". The "all" has the context, and we do
    not allow SELinux relabelling within containers.

    Splitting the "-a" to "-dR --preserve" will provide the same end results, but
    without the relabelling, preventing audit.log to fill up during the deploy.

    Closes-Bug: #1819459
    Change-Id: Ic280ad8e95fcc32986987f5abaa524f171d7c13b

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 10.5.0 release.