{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/21673","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/21673/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/21673/comments","events_url":"https://api.github.com/repos/docker/docker/issues/21673/events","html_url":"https://github.com/docker/docker/pull/21673","id":144767755,"number":21673,"title":"Mark Docker log files as docker_log_t","user":{"login":"elyscape","id":792695,"avatar_url":"https://avatars.githubusercontent.com/u/792695?v=3","gravatar_id":"","url":"https://api.github.com/users/elyscape","html_url":"https://github.com/elyscape","followers_url":"https://api.github.com/users/elyscape/followers","following_url":"https://api.github.com/users/elyscape/following{/other_user}","gists_url":"https://api.github.com/users/elyscape/gists{/gist_id}","starred_url":"https://api.github.com/users/elyscape/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elyscape/subscriptions","organizations_url":"https://api.github.com/users/elyscape/orgs","repos_url":"https://api.github.com/users/elyscape/repos","events_url":"https://api.github.com/users/elyscape/events{/privacy}","received_events_url":"https://api.github.com/users/elyscape/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/2-code-review","name":"status/2-code-review","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":26,"created_at":"2016-03-31T02:01:10Z","updated_at":"2016-04-04T22:09:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/21673","html_url":"https://github.com/docker/docker/pull/21673","diff_url":"https://github.com/docker/docker/pull/21673.diff","patch_url":"https://github.com/docker/docker/pull/21673.patch"},"body":"**What I did**\r\nAs documented in #21672, log files are currently created with the wrong SELinux type. This pull request ensures that log files have the correct type.\r\n\r\n**How I did it**\r\nI added the log file path to the SELinux file context list so that `restorecon`, if run on Docker log files, would correctly assign them the `docker_log_t` type instead of `docker_var_lib_t`. I also made Docker assign the correct type to log files immediately after creation. My rationale for assigning the type in Docker rather than in an SELinux policy is that it is impossible to do so in a policy because:\r\n\r\n1. The log files are created by a `docker_t` executable in a `docker_var_lib_t` directory, but\r\n2. They are the only files with those properties that also need to be tagged as `docker_log_t` (preventing the use of a standard file transition), and\r\n3. They do not have a standard filename (preventing the use of a file name transition).\r\n\r\nI experimented with standardizing the filename as `json.log`, but that caused some issues, specifically:\r\n\r\n1. Running `docker log` on containers that existed before the change resulted in Docker not reading from the existing logfiles, despite the fact that `docker inspect` showed the correct (i.e. old) value for `LogPath`.\r\n2. Some downstream projects (e.g. [Kubernetes][k8s-is-dumb]) use the log files but, rather than querying Docker for the location, basically replicate [the logic used to construct the `LogPath`][container-logpath].\r\n\r\nUltimately, this appeared to be the best way forward.\r\n\r\n[k8s-is-dumb]: https://github.com/kubernetes/kubernetes/blob/v1.2.0/pkg/kubelet/dockertools/manager.go#L1537\r\n[container-logpath]: https://github.com/docker/docker/blob/v1.10.3/container/container.go#L301\r\n\r\n**How to verify it**\r\n\r\n1. On a system with SELinux, run something in a container: `docker run busybox echo hi`\r\n2. Find the container ID: `CID=\"$(docker ps -ql)\" ; echo $CID`\r\n3. Find the container's log path: `LOGPATH=\"$(docker inspect --format '{{ .LogPath }}' $CID)\" ; echo $LOGPATH`\r\n4. View the SELinux context of the log file: `ls -Z $LOGPATH`\r\n\r\nThe output should be something like this:\r\n\r\n```shellsession\r\n$ docker run busybox echo hi\r\nhi\r\n$ CID=\"$(docker ps -ql)\" ; echo $CID\r\n266767c59143\r\n$ LOGPATH=\"$(docker inspect --format '{{ .LogPath }}' $CID)\" ; echo $LOGPATH\r\n/var/lib/docker/containers/266767c59143a16761a4a7cb06d8f35604a1b7facb30bb020219fe2c29b32913/266767c59143a16761a4a7cb06d8f35604a1b7facb30bb020219fe2c29b32913-json.log\r\n$ ls -Z $LOGPATH\r\n-rw-------. root root system_u:object_r:docker_log_t:s0 /var/lib/docker/containers/266767c59143a16761a4a7cb06d8f35604a1b7facb30bb020219fe2c29b32913/266767c59143a16761a4a7cb06d8f35604a1b7facb30bb020219fe2c29b32913-json.log\r\n```\r\n\r\nThat is to say, the log file should have type `docker_log_t`.\r\n\r\n**A picture of a cute animal (not mandatory but encouraged)**\r\n![Tweetie and Blue](http://itburns.net/brokenforum/tweetie-and-blue.jpg)\r\n\r\nFixes #21672.\r\n\r\nSigned-off-by: Eli Young <elyscape@gmail.com>"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/205517922","html_url":"https://github.com/docker/docker/pull/21673#issuecomment-205517922","issue_url":"https://api.github.com/repos/docker/docker/issues/21673","id":205517922,"user":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"created_at":"2016-04-04T22:09:20Z","updated_at":"2016-04-04T22:09:20Z","body":"I think the discussion is going way beyond the original intent here. Note that these log files are meant to be consumed by the docker JSON-file log driver, **not** for any external tool using them (as is the case for *anything* inside `/var/lib/docker`). Is renaming the files needed in order to apply the SELinux label?"}}