LXC system initialization (exec of /sbin/init denied)
![Post Post](./styles/prosilver/imageset/icon_post_target.gif)
Hi.
I try to run lxc-start on RBAC-enabled system with special role.
In learning mode lxc-container starts and works.
But with `gradm -E` and auto generated config (https://dpaste.de/zHNS/raw)
I got the /sbin/init denied message in kernel log's.
I try to run lxc-start on RBAC-enabled system with special role.
In learning mode lxc-container starts and works.
But with `gradm -E` and auto generated config (https://dpaste.de/zHNS/raw)
I got the /sbin/init denied message in kernel log's.
- Code: Select all
Dec 14 20:29:43 hellstation kernel: grsec: (root:U:/sbin/gradm) exec of /sbin/gradm (gradm -a lxc ) by /sbin/gradm[bash:18327] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:11348] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:45 hellstation kernel: grsec: (root:U:/sbin/gradm) successful change to special role lxc (id 40) by /sbin/gradm[gradm:18327] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:11348] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/usr/sbin/lxc-start) exec of /usr/sbin/lxc-start (lxc-start -n server ) by /usr/sbin/lxc-start[bash:18328] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:11348] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: IPv6: ADDRCONF(NETDEV_UP): server0: link is not ready
Dec 14 20:29:48 hellstation kernel: IPv6: ADDRCONF(NETDEV_UP): server1: link is not ready
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/bin/bash) exec of /bin/bash (sh -c /etc/lxc/server/if-up.sh server net up veth server1 ) by /bin/bash[lxc-start:18332] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/lxc-start[lxc-start:18328] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/bin/bash) exec of /etc/lxc/server/if-up.sh (/etc/lxc/server/if-up.sh server net up veth server1 ) by /etc/lxc/server/if-up.sh[sh:18332] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/lxc-start[lxc-start:18328] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/sbin/brctl) exec of /sbin/brctl (brctl addif br0 server0 ) by /sbin/brctl[if-up.sh:18337] uid/euid:0/0 gid/egid:0/0, parent /etc/lxc/server/if-up.sh[if-up.sh:18332] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: device server0 entered promiscuous mode
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/bin/ifconfig) exec of /bin/ifconfig (ifconfig server0 up ) by /bin/ifconfig[if-up.sh:18338] uid/euid:0/0 gid/egid:0/0, parent /etc/lxc/server/if-up.sh[if-up.sh:18332] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/sbin/brctl) exec of /sbin/brctl (brctl addif br1 server1 ) by /sbin/brctl[if-up.sh:18340] uid/euid:0/0 gid/egid:0/0, parent /etc/lxc/server/if-up.sh[if-up.sh:18332] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: device server1 entered promiscuous mode
Dec 14 20:29:48 hellstation kernel: br1: port 1(server1) entered forwarding state
Dec 14 20:29:48 hellstation kernel: br1: port 1(server1) entered forwarding state
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/bin/ifconfig) exec of /bin/ifconfig (ifconfig server1 up ) by /bin/ifconfig[if-up.sh:18341] uid/euid:0/0 gid/egid:0/0, parent /etc/lxc/server/if-up.sh[if-up.sh:18332] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/bin/bash) exec of /bin/bash (sh -c zfs list 2> /dev/null ) by /bin/bash[lxc-start:18350] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/lxc-start[lxc-start:18346] uid/euid:0/0 gid/egid:0/0
Dec 14 20:29:48 hellstation kernel: eth0: renamed from vethAJGVV4
Dec 14 20:29:48 hellstation kernel: eth1: renamed from veth1HYV91
Dec 14 20:29:48 hellstation kernel: EXT4-fs (dm-32): mounted filesystem with ordered data mode. Opts: (null)
Dec 14 20:29:48 hellstation kernel: EXT4-fs (dm-33): mounted filesystem with ordered data mode. Opts: (null)
Dec 14 20:29:48 hellstation kernel: EXT4-fs (dm-34): mounted filesystem with ordered data mode. Opts: (null)
Dec 14 20:29:48 hellstation kernel: grsec: (lxc:S:/usr/sbin/lxc-start) [b]denied execution of /sbin/init[/b] by /usr/sbin/lxc-start[lxc-start:18346] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/lxc-start[lxc-start:18328] uid/euid:0/0 gid/egid:0/0