From ebcb60f77da1ee4c31f37e753cc09eb5f2d2aef7 Mon Sep 17 00:00:00 2001 From: Alex Pyrgiotis Date: Mon, 29 Jul 2024 23:49:58 +0300 Subject: [PATCH] doc: Add troubeshooting guide for SELinux errors Mention two SELinux-related errors that we have seen in Fedora systems, explain how can the user verify that they trigger them, and provide a workaround. The first error that we mention will be triggered by every user running gVisor in a Fedora system, so it's good to have a solution for them. The second error was found during the development of Dangerzone, which uses a nested gVisor container within a rootless Podman container. This use case is niche, but it still may help people who are experimenting with gVisor within another container. Refs freedomofpress/dangerzone#880 --- g3doc/user_guide/FAQ.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/g3doc/user_guide/FAQ.md b/g3doc/user_guide/FAQ.md index b789e5db3..04fccb12b 100644 --- a/g3doc/user_guide/FAQ.md +++ b/g3doc/user_guide/FAQ.md @@ -160,6 +160,39 @@ This error may happen when using `gvisor-containerd-shim` with a `containerd` that does not contain the fix for [CVE-2020-15257]. The resolve the issue, update containerd to 1.3.9 or 1.4.3 (or newer versions respectively). +### I'm getting an error like `SELinux is not supported: system_u:system_r:container_t:s0:...` + +This error may happen in systems where SELinux is enabled. You can check this is +the case with the `sestatus` command: + +``` +$ sudo sestatus +SELinux status: enabled +[...] +``` + +Since gVisor does not support setting SELinux labels, you can disable SELinux +specifically for the new container by passing the `--security-opt label=disable` +argument during its creation. + +### I'm getting an error like `error remounting chroot in read-only: permission denied` {#selinux-nested} + +This error may happen when gVisor is running **within** a container, in a +system with SELinux in **enforcing** mode. To ensure this is the case, check +your system's audit logs (e.g., `journalctl`) for SELinux denials like the +following: + +``` +AVC avc: denied { mounton } for ... scontext=... tcontext=... permissive=0 +``` + +To resolve this issue, label the **outer** container with the +`container_engine_t` SELinux label, by passing the +`--security-opt label=type:container_engine_t` argument during its creation. + +This SELinux label is reserved for running a container engine (here gVisor) +within another container (e.g., Docker or Podman). + [security-model]: /docs/architecture_guide/security/ [host-net]: /docs/user_guide/networking/#network-passthrough [debugging]: /docs/user_guide/debugging/