Debian Bug report logs - #736909
LXC selinux support not working

version graph

Package: selinux-policy-default; Maintainer for selinux-policy-default is Debian SELinux maintainers <[email protected]>; Source for selinux-policy-default is src:refpolicy (PTS, buildd, popcon).

Affects: libvirt-bin, libvirt

Reported by: Laurent Bigonville <[email protected]>

Date: Wed, 19 Sep 2012 22:54:02 UTC

Severity: important

Found in version refpolicy/2:2.20131214-1

Forwarded to [email protected]

Full log


🔗 View this message in rfc822 format

X-Loop: [email protected]
Subject: Bug#736909: where are we at with this?
Reply-To: Laurent Bigonville <[email protected]>, [email protected]
Resent-From: Laurent Bigonville <[email protected]>
Resent-To: [email protected]
Resent-CC: Debian SELinux maintainers <[email protected]>
X-Loop: [email protected]
Resent-Date: Tue, 27 Dec 2016 20:51:03 +0000
Resent-Message-ID: <[email protected]>
Resent-Sender: [email protected]
X-Debian-PR-Message: followup 736909
X-Debian-PR-Package: selinux-policy-default
X-Debian-PR-Keywords: 
X-Debian-PR-Source: refpolicy, selinux-policy-default
Received: via spool by [email protected] id=B736909.148287179424285
          (code B ref 736909); Tue, 27 Dec 2016 20:51:03 +0000
Received: (at 736909) by bugs.debian.org; 27 Dec 2016 20:49:54 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.0-bugs.debian.org_2005_01_02
	(2014-02-07) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.0 required=4.0 tests=BAYES_00,FROMDEVELOPER,
	SPF_HELO_PASS autolearn=ham autolearn_force=no
	version=3.4.0-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 20; hammy, 147; neutral, 68; spammy,
	3. spammytokens:0.998-1--H*Ad:U*zone, 0.995-1--H*M:dd74, 0.987-1--H*M:dd1f
	hammytokens:0.000-+--H*UA:45.0, 0.000-+--H*u:45.0, 0.000-+--H*F:U*bigon,
	0.000-+--H*rp:U*bigon, 0.000-+--H*r:bigon
Received: from anor.bigon.be ([91.121.173.99] ident=postfix)
	by buxtehude.debian.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.84_2)
	(envelope-from <[email protected]>)
	id 1cLyh0-0006JF-9Y
	for [email protected]; Tue, 27 Dec 2016 20:49:54 +0000
Received: from anor.bigon.be (localhost.localdomain [127.0.0.1])
	by anor.bigon.be (Postfix) with ESMTP id 81BC61A1A8;
	Tue, 27 Dec 2016 21:49:50 +0100 (CET)
X-Virus-Scanned: Debian amavisd-new at bigon.be
Received: from anor.bigon.be ([127.0.0.1])
	by anor.bigon.be (anor.bigon.be [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id 6mb-QMx25f1z; Tue, 27 Dec 2016 21:49:48 +0100 (CET)
Received: from [IPv6:2a02:a03f:6c:e500:edf:2fd8:fc0a:f176] (unknown [IPv6:2a02:a03f:6c:e500:edf:2fd8:fc0a:f176])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(Client did not present a certificate)
	(Authenticated sender: bigon)
	by anor.bigon.be (Postfix) with ESMTPSA id 6D6291A1A1;
	Tue, 27 Dec 2016 21:49:48 +0100 (CET)
From: Laurent Bigonville <[email protected]>
To: [email protected], [email protected]
References: <[email protected]>
Cc: Guido Günther <[email protected]>,
 Mateusz Matuszkowiak <[email protected]>, Evgeni Golov <[email protected]>
Message-ID: <[email protected]>
Date: Tue, 27 Dec 2016 21:49:47 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Icedove/45.5.1
MIME-Version: 1.0
In-Reply-To: <[email protected]>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
Hi Russell,


Le 27/12/16 à 13:20, Russell Coker a écrit :
> The lxc_contents file is in selinux-policy-default and a quick check indicates
> that the policy might be ok.
>
> What do we have to do to test it?  I can provide root on a test system to
> anyone who wants to help test this.
>

The initial bug, the fact that libvirt is not starting is fixed at two 
different level, libvirt now checks if the lxc_context file is present 
or not before doing any SELinux operations and it's also fixed now that 
the policy ships this file.

But I just tried now (with the refpolicy) and all the processes are 
running under "system_u:system_r:virtd_lxc_t:s0-s0:c0.c1023" (not sure 
it's the one expected here), so we might have an other problem here.

My test case is quite easy, I've debootstrapped a debian unstable 
(debootstrap sid /tmp/sid). Then in virt-manager, I've added a new "LXC" 
connection and then created a new "system" container. And then started 
that container.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <[email protected]>. Last modified: Thu May 15 15:32:41 2025; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.