{"action":"created","issue":{"url":"https://api.github.com/repos/moby/moby/issues/33389","repository_url":"https://api.github.com/repos/moby/moby","labels_url":"https://api.github.com/repos/moby/moby/issues/33389/labels{/name}","comments_url":"https://api.github.com/repos/moby/moby/issues/33389/comments","events_url":"https://api.github.com/repos/moby/moby/issues/33389/events","html_url":"https://github.com/moby/moby/issues/33389","id":231216681,"number":33389,"title":"`Permission denied` when trying to access volume while selinux-enabled=true","user":{"login":"MohdAhmad","id":1475849,"avatar_url":"https://avatars0.githubusercontent.com/u/1475849?v=4","gravatar_id":"","url":"https://api.github.com/users/MohdAhmad","html_url":"https://github.com/MohdAhmad","followers_url":"https://api.github.com/users/MohdAhmad/followers","following_url":"https://api.github.com/users/MohdAhmad/following{/other_user}","gists_url":"https://api.github.com/users/MohdAhmad/gists{/gist_id}","starred_url":"https://api.github.com/users/MohdAhmad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MohdAhmad/subscriptions","organizations_url":"https://api.github.com/users/MohdAhmad/orgs","repos_url":"https://api.github.com/users/MohdAhmad/repos","events_url":"https://api.github.com/users/MohdAhmad/events{/privacy}","received_events_url":"https://api.github.com/users/MohdAhmad/received_events","type":"User","site_admin":false},"labels":[{"id":480238176,"url":"https://api.github.com/repos/moby/moby/labels/version/1.13","name":"version/1.13","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-05-25T01:37:26Z","updated_at":"2018-02-21T17:50:21Z","closed_at":null,"author_association":"NONE","body":"**Description**\r\nWith selinux enabled on the host and for the docker daemon, I get a `permission denied` when trying to access the volume. Propagated mount for the volume plugin is set to `/var/lib/test`.  Running the container with `--security-opt=label:disable` resolves the issue. How can I get around this without disabling selinux?\r\n\r\n**Steps to reproduce the issue:**\r\n1. Enable selinux on the host\r\n2. Start docker with selinux enabled\r\n3. Launch the nutanix volume plugin\r\n4. Create a volume\r\n5. Mount the volume to a container\r\n\r\n**Describe the results you received:**\r\nI get a `Permission denied` for all read write operations inside the directory.\r\n\r\n**Describe the results you expected:**\r\nTo be able to read write files in the volume.\r\n\r\n**Output of `docker version`:**\r\nThe issue is seen with \r\n```\r\nDocker version:\r\nClient:\r\n Version:         1.13.1\r\n API version:     1.26\r\n Package version: docker-common-1.12.6-16.el7.centos.x86_64\r\n Go version:      go1.7.4\r\n Git commit:      6774275/1.13.1\r\n Built:           Wed Apr 19 12:52:58 2017\r\n OS/Arch:         linux/amd64\r\n\r\nServer:\r\n Version:         1.13.1\r\n API version:     1.26 (minimum version 1.12)\r\n Package version: docker-common-1.12.6-16.el7.centos.x86_64\r\n Go version:      go1.7.4\r\n Git commit:      6774275/1.13.1\r\n Built:           Wed Apr 19 12:52:58 2017\r\n OS/Arch:         linux/amd64\r\n Experimental:    false\r\n\r\n```\r\n\r\n**Output of `docker info`:**\r\n\r\n```\r\nContainers: 1\r\n Running: 0\r\n Paused: 0\r\n Stopped: 1\r\nImages: 10\r\nServer Version: 1.13.1\r\nStorage Driver: devicemapper\r\n Pool Name: docker-253:0-101045825-pool\r\n Pool Blocksize: 65.54 kB\r\n Base Device Size: 10.74 GB\r\n Backing Filesystem: xfs\r\n Data file: /dev/loop0\r\n Metadata file: /dev/loop1\r\n Data Space Used: 755.8 MB\r\n Data Space Total: 107.4 GB\r\n Data Space Available: 50.46 GB\r\n Metadata Space Used: 1.475 MB\r\n Metadata Space Total: 2.147 GB\r\n Metadata Space Available: 2.146 GB\r\n Thin Pool Minimum Free Space: 10.74 GB\r\n Udev Sync Supported: true\r\n Deferred Removal Enabled: false\r\n Deferred Deletion Enabled: false\r\n Deferred Deleted Device Count: 0\r\n Data loop file: /var/lib/docker-latest/devicemapper/devicemapper/data\r\n WARNING: Usage of loopback devices is strongly discouraged for production use. Use `--storage-opt dm.thinpooldev` to specify a custom block storage device.\r\n Metadata loop file: /var/lib/docker-latest/devicemapper/devicemapper/metadata\r\n Library Version: 1.02.135-RHEL7 (2016-11-16)\r\nLogging Driver: journald\r\nCgroup Driver: systemd\r\nPlugins:\r\n Volume: local\r\n Network: bridge host macvlan null overlay\r\nSwarm: inactive\r\nRuntimes: docker-runc runc\r\nDefault Runtime: docker-runc\r\nInit Binary: docker-init\r\ncontainerd version:  (expected: aa8187dbd3b7ad67d8e5e3a15115d3eef43a7ed1)\r\nrunc version: N/A (expected: 9df8b306d01f59d3a8029be411de015b7304dd8f)\r\ninit version: N/A (expected: 949e6facb77383876aeff8a6944dde66b3089574)\r\nSecurity Options:\r\n seccomp\r\n  Profile: default\r\n selinux\r\nKernel Version: 3.10.0-514.16.1.el7.x86_64\r\nOperating System: CentOS Linux 7 (Core)\r\nOSType: linux\r\nArchitecture: x86_64\r\nNumber of Docker Hooks: 2\r\nCPUs: 8\r\nTotal Memory: 7.62 GiB\r\nName: localhost.localdomain\r\nID: ZVKZ:BOWZ:GX7Y:EINA:F6RZ:CGJB:22ML:BNMI:2FIL:ZRMS:QYMS:RCQC\r\nDocker Root Dir: /var/lib/docker-latest\r\nDebug Mode (client): false\r\nDebug Mode (server): false\r\nUsername: mohdahmad\r\nRegistry: https://index.docker.io/v1/\r\nExperimental: false\r\nInsecure Registries:\r\n 127.0.0.0/8\r\nLive Restore Enabled: false\r\nRegistries: docker.io (secure)\r\n```\r\n\r\n**Additional information you deem important (e.g. issue happens only occasionally):**\r\nFrom syslogs when container created with the volume mounted\r\n```kernel: SELinux: mount invalid.  Same superblock, different security settings for (dev mqueue, type mqueue)```\r\n\r\nFrom syslogs when running `ls` inside the directory.\r\n```localhost journal: ls: cannot open directory '.': Permission denied#015```\r\n\r\nFrom docker logs when runnign `ls` inside the directory.\r\n``` [55B blob data]\r\n[57B blob data]\r\n[49B blob data]```"},"comment":{"url":"https://api.github.com/repos/moby/moby/issues/comments/367411576","html_url":"https://github.com/moby/moby/issues/33389#issuecomment-367411576","issue_url":"https://api.github.com/repos/moby/moby/issues/33389","id":367411576,"user":{"login":"jcmcken","id":1117819,"avatar_url":"https://avatars0.githubusercontent.com/u/1117819?v=4","gravatar_id":"","url":"https://api.github.com/users/jcmcken","html_url":"https://github.com/jcmcken","followers_url":"https://api.github.com/users/jcmcken/followers","following_url":"https://api.github.com/users/jcmcken/following{/other_user}","gists_url":"https://api.github.com/users/jcmcken/gists{/gist_id}","starred_url":"https://api.github.com/users/jcmcken/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcmcken/subscriptions","organizations_url":"https://api.github.com/users/jcmcken/orgs","repos_url":"https://api.github.com/users/jcmcken/repos","events_url":"https://api.github.com/users/jcmcken/events{/privacy}","received_events_url":"https://api.github.com/users/jcmcken/received_events","type":"User","site_admin":false},"created_at":"2018-02-21T17:50:21Z","updated_at":"2018-02-21T17:50:21Z","author_association":"NONE","body":"I've tried 17.09 and 17.12 and running with SELinux in permissive mode and still have this issue. Mounting the volumes with ``:z`` or ``:Z`` relabels everything, but doesn't resolve the issue. Only setting ``selinux-enabled`` to ``false`` seems to fix the issue. I see no SELinux AVCs in my audit logs. Overall, very strange behavior.\r\n\r\n"}}
{"actor":{"display_login":"jcmcken"}}