Running ipcs from busybox doesn't work inside container

[filbranden]

Hi @rhatdan,

Running the ipcs command from busybox doesn't work inside a Docker container. The one from util-linux works, but not the one from busybox.

It turns out their implementation is different, the one from busybox starts by calling shmctl(0, SHM_INFO, ...) while the one from util-linux tries to access the /proc files first and only falls back to IPC_INFO if that fails.

This is the end result:

$ docker run busybox ipcs

kernel not configured for message queues

kernel not configured for shared memory

kernel not configured for semaphores

While the same works when running from a container that ships util-linux:

$ docker run fedora ipcs

------ Message Queues --------
key        msqid      owner      perms      used-bytes   messages    

------ Shared Memory Segments --------
key        shmid      owner      perms      bytes      nattch     status      

------ Semaphore Arrays --------
key        semid      owner      perms      nsems     

Considering the functionality itself is not blocked (and accessing that information from the files under /proc/sysvipc/ works), I think this should be corrected by allowing IPC info inside a container.

I'll send a PR shortly that fixes this issue.

/cc @Random-Liu since this came up in kubernetes/kubernetes#58174

[rhatdan]

What AVC's are you seeing.

[filbranden]

type=AVC msg=audit(1516749755.086:762): avc:  denied  { ipc_info } for  pid=9883 comm="ipcs" scontext=system_u:system_r:container_t:s0:c917,c993 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
type=AVC msg=audit(1516749755.086:763): avc:  denied  { ipc_info } for  pid=9883 comm="ipcs" scontext=system_u:system_r:container_t:s0:c917,c993 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
type=AVC msg=audit(1516749755.086:764): avc:  denied  { ipc_info } for  pid=9883 comm="ipcs" scontext=system_u:system_r:container_t:s0:c917,c993 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0

[rhatdan]

Ok I have pushed a fix for this. and am building new packages.

Fixed in container-selinux-2.44-1