Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-16344

AVC denials messages to unmount operation when stopping a podman container

Details

    • sst_container_tools
    • 3
    • False
    • Hide

      None

      Show
      None

    Description

      What were you trying to do that didn't work?

      • Podman stop does not unmount a mount point.

        Please provide the package NVR for which bug is seen:

      Red Hat Enterprise Linux 8.8
      Podman 4.4.1

      How reproducible:

      Steps to reproduce

      1.  Start a podman contianer
      2. podman run -d --name container_abc  -v /mnt/abc:/opt/app/app-manage/clock:ro --cap-add=SYS_ADMIN,SYS_RESOURCE container_image:tag
      1.  The volume get successfully mounted.

                  [root@abc /]# podman exec -it container_abc  /bin/bash
                  [root@container_abc /]# df         ----> check the mounted volume.

             3.  [root@container_abc/]# ls -Z /opt/app/app-manage/clock
      system_u:object_r:locale_t:s0 lost+found   ------------> volume mounted inside the container

             4. Stop the container to see  AVC denial:
                    # podman stop container_abc
                    # grep -i avc /var/log/audit/audit.log | ausearch -i | grep "unmount"
                node=localhost.localdomain type=AVC msg=audit(10/26/2023 18:38:35.774:1175336) : avc:  denied  { unmount } for  pid=278152 comm=umount scontext=system_u:system_r:container_init_t:s0:c246,c898 tcontext=system_u:object_r:locale_t:s0 tclass=filesystem permissive=0

      Expected results

      • AVC should not report {unmount} errors on podman stop.
      • podman stop should unmoun the mounted volume.

      Actual results

      • AVC reports {unmount} errors on podman stop.
      • podman stop does not unmount mounted volume.

       

      -

      Attachments

        Activity

          People

            dwalsh@redhat.com Daniel Walsh
            rhn-support-cpippin Carroline Pippin
            Container Runtime Eng Bot Container Runtime Eng Bot
            Container Runtime Bugs Bot Container Runtime Bugs Bot
            Votes:
            0 Vote for this issue
            Watchers:
            10 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: