{"action":"created","issue":{"url":"https://api.github.com/repos/sameersbn/docker-nginx/issues/3","repository_url":"https://api.github.com/repos/sameersbn/docker-nginx","labels_url":"https://api.github.com/repos/sameersbn/docker-nginx/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/sameersbn/docker-nginx/issues/3/comments","events_url":"https://api.github.com/repos/sameersbn/docker-nginx/issues/3/events","html_url":"https://github.com/sameersbn/docker-nginx/issues/3","id":131240547,"number":3,"title":"Consider adding selinux policy?","user":{"login":"croepha","id":716462,"avatar_url":"https://avatars.githubusercontent.com/u/716462?v=3","gravatar_id":"","url":"https://api.github.com/users/croepha","html_url":"https://github.com/croepha","followers_url":"https://api.github.com/users/croepha/followers","following_url":"https://api.github.com/users/croepha/following{/other_user}","gists_url":"https://api.github.com/users/croepha/gists{/gist_id}","starred_url":"https://api.github.com/users/croepha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/croepha/subscriptions","organizations_url":"https://api.github.com/users/croepha/orgs","repos_url":"https://api.github.com/users/croepha/repos","events_url":"https://api.github.com/users/croepha/events{/privacy}","received_events_url":"https://api.github.com/users/croepha/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-04T04:35:05Z","updated_at":"2016-02-04T16:19:16Z","closed_at":null,"body":"I am not even sure if this is a good idea, as I really dont understand what the attached selinux policy is supposed to do, or why it isn't default on my setup (Fedora Server)  but with selinux I was getting some weird errors:\r\n\r\n```\r\nnginx: [error] [ngx_pagespeed 1.9.32.10-7423] Unable to create SHM segment [1]globalstatistics, mmap failed with errno=13.\r\nnginx: [warn] [ngx_pagespeed 1.9.32.10-7423] Problem during shared memory setup; statistics functionality unavailable.\r\nnginx: [error] [ngx_pagespeed 1.9.32.10-7423] Unable to create SHM segment [1]dummy_hostname:-1statistics, mmap failed with errno=13.\r\nnginx: [warn] [ngx_pagespeed 1.9.32.10-7423] Problem during shared memory setup; statistics functionality unavailable.\r\nnginx: [error] [ngx_pagespeed 1.9.32.10-7423] Unable to create SHM segment [1]pagespeed_default_shm/metadata_cache, mmap failed with errno=13.\r\nnginx: [error] [ngx_pagespeed 1.9.32.10-7423] SharedMemCache: can't create segment pagespeed_default_shm/metadata_cache of size 52445184\r\nnginx: [error] [ngx_pagespeed 1.9.32.10-7423] Unable to create SHM segment [1]/named_locks, mmap failed with errno=13.\r\nnginx: [error] [ngx_pagespeed 1.9.32.10-7423] Unable to create memory segment for locks.\r\n```\r\n\r\nThis selinux policy will silence the error, and allow you to use selinux:\r\n\r\n```\r\nmodule sameersbn-docker-nginx 1.0;\r\n\r\nrequire {\r\n\ttype svirt_lxc_net_t;\r\n\ttype svirt_sandbox_file_t;\r\n\tclass chr_file execute;\r\n}\r\n\r\n#============= svirt_lxc_net_t ==============\r\n\r\n#!!!! The file '/dev/zero' is mislabeled on your system.\r\n#!!!! Fix with $ restorecon -R -v /dev/zero\r\nallow svirt_lxc_net_t svirt_sandbox_file_t:chr_file execute;\r\n```\r\n\r\nI save that file as `sameersbn-docker-nginx.te`\r\nThen run these commands:\r\n```\r\ncheckmodule -M -m -o sameersbn-docker-nginx.mod sameersbn-docker-nginx.te\r\nsemodule_package -o sameersbn-docker-nginx.pp -m sameersbn-docker-nginx.mod\r\nsudo semodule -i sameersbn-docker-nginx.pp\r\n```\r\n\r\nAnyway, that might be an easy workaround for some people still wanting to use selinux...\r\n\r\nAgain, I really dont understand that this policy is doing, and what it has to do with shared memory, I went ahead and tried a generic mmap test (https://gist.github.com/kashyapp/4385922#file-mmap-fork-c)  in this with this docker image and selinux enabled, and it worked with no problem,  The only reason I used this policy is because it was generated with audit2allow, so it may be phony or incorrect or missing the bigger picture.... but I figured this might help someone, if you think this is out of scope, then i'll close"},"comment":{"url":"https://api.github.com/repos/sameersbn/docker-nginx/issues/comments/179926309","html_url":"https://github.com/sameersbn/docker-nginx/issues/3#issuecomment-179926309","issue_url":"https://api.github.com/repos/sameersbn/docker-nginx/issues/3","id":179926309,"user":{"login":"sameersbn","id":410147,"avatar_url":"https://avatars.githubusercontent.com/u/410147?v=3","gravatar_id":"","url":"https://api.github.com/users/sameersbn","html_url":"https://github.com/sameersbn","followers_url":"https://api.github.com/users/sameersbn/followers","following_url":"https://api.github.com/users/sameersbn/following{/other_user}","gists_url":"https://api.github.com/users/sameersbn/gists{/gist_id}","starred_url":"https://api.github.com/users/sameersbn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sameersbn/subscriptions","organizations_url":"https://api.github.com/users/sameersbn/orgs","repos_url":"https://api.github.com/users/sameersbn/repos","events_url":"https://api.github.com/users/sameersbn/events{/privacy}","received_events_url":"https://api.github.com/users/sameersbn/received_events","type":"User","site_admin":false},"created_at":"2016-02-04T16:19:16Z","updated_at":"2016-02-04T16:19:16Z","body":"should we distribute this in the git repo?"}}