[RHEL 8] Allow user_t and container_runtime_t to exchange dbus messages#448
[RHEL 8] Allow user_t and container_runtime_t to exchange dbus messages#448lsm5 wants to merge 1 commit intocontainers:mainfrom
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates SELinux policy for containers on RHEL 8 so that, when the user_t_run_containers tunable is enabled, user_t and container_runtime_t domains are allowed to exchange D-Bus messages, preventing rootless Podman/systemd user-session hangs caused by blocked D-Bus replies. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a critical SELinux policy gap in RHEL 8 that caused rootless Podman to hang during D-Bus communication with the systemd user session. By introducing specific D-Bus Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds SELinux rules to permit bidirectional D-Bus communication between the user_t and container_runtime_t contexts. This change is necessary on RHEL 8 to allow rootless Podman, running as container_runtime_t, to communicate with the systemd user session, running as user_t, for cgroup management. Without these rules, Podman hangs while waiting for a D-Bus reply that is blocked by SELinux. The new rules are correctly placed within the user_t_run_containers tunable, which is disabled by default, ensuring the change is opt-in for administrators. The change is correct and effectively resolves the issue.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
@containers/container-selinux-maintainers PTAL. Required only by rhel8 but shouldn't hurt to be on main. Just that having this present upstream makes it easy to point to. |
When user_t runs rootless podman (which transitions to container_runtime_t), podman communicates with the systemd user session (user_t) via D-Bus to manage cgroups by calling StartTransientUnit. Without this rule, systemd processes the request but SELinux blocks the D-Bus reply from user_t back to container_runtime_t. Podman then hangs indefinitely waiting for a response that never arrives. This denial doesn't show in the audit log as AVC because D-Bus access denials are handled by dbus-daemon itself, only visible via dbus-monitor as org.freedesktop.DBus.Error.AccessDenied: ``` error_name=org.freedesktop.DBus.Error.AccessDenied "An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_return", sender=":1.1" (uid=1001 pid=9877 comm="/usr/lib/systemd/systemd --user " label="user_u:user_r:user_t:s0") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.4" (uid=1001 pid=9917 comm="podman images " label="user_u:user_r:container_runtime_t:s0")" ``` Add dbus send_msg rules between user_t and container_runtime_t inside the user_t_run_containers tunable to allow this communication. This fix is specific to RHEL8 which uses `dbus-daemon` that enforces SELinux send_msg checks between peers. RHEL9+ and Fedora use `dbus-broker` which does not enforce peer-to-peer send_msg checks, so this rule is not needed there but is harmless. Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
|
Tests failed. @containers/packit-build please check. |
|
Does Podman work on RHEL8? Or is this a badly named branch. LGTM |
It does, well whatever version is already shipped on RHEL 8.10. And only RHEL8 needs this additional patch.
Thanks. |
|
/packit retest-failed |
2 participants
When user_t runs rootless podman (which transitions to container_runtime_t), podman communicates with the systemd user session (user_t) via D-Bus to manage cgroups by calling StartTransientUnit.
Without this rule, systemd processes the request but SELinux blocks the D-Bus reply from user_t back to container_runtime_t. Podman then hangs indefinitely waiting for a response that never arrives. This denial doesn't show in the audit log as AVC because D-Bus access denials are handled by dbus-daemon itself, only visible via dbus-monitor as org.freedesktop.DBus.Error.AccessDenied:
Add dbus send_msg rules between user_t and container_runtime_t inside the user_t_run_containers tunable to allow this communication.
This fix is specific to RHEL8 which uses
dbus-daemonthat enforces SELinux send_msg checks between peers. RHEL9+ and Fedora usedbus-brokerwhich does not enforce peer-to-peer send_msg checks, so this rule is not needed there but is harmless.Summary by Sourcery
Bug Fixes: