systemd-executor : SELinux : Permission Denied [hawser]

[riskwise99]

After the recent tweaks required for OpenRC and hawser to get along, I've now been confronted by a Rocky Linux issue this time with hawser & systemd-executor. Same or similar behaviour should be exhibited on Fedora and RHEL.

I've done the troubleshooting, and I suggest maybe an entry in the readme.MD along these lines might save others from pulling at their hair :-)

Troubleshooting

SELinux: Permission denied (systemd-executor)

RHEL, Rocky Linux, and Fedora, you may see errors like this in journalctl

Failed at step NAMESPACE spawning /usr/local/bin/hawser: Permission denied
Failed to mount /run/systemd/mount-rootfs/run/docker.sock: Permission denied

This is caused by SELinux blocking systemd from creating a mount namespace for hardening when the Docker socket is involved. To fix this, ensure the following lines are commented out in your /etc/systemd/system/hawser.service:

# ProtectSystem=full
# ProtectHome=true
# ReadWritePaths=/run/docker.sock /data/stacks

Then reload and restart:

sudo systemctl daemon-reload
sudo systemctl restart hawser

[jotka]

awesome thanks @riskwise99!

[bigntallmike]

FYI I'm using the following SELinux TE to make it work with SELinux enabled (Rocky 9.7):

hawser.te 

module hawser 1.0;

require {
	type container_var_run_t;
	type init_t;
	class sock_file mounton;
}

#============= init_t ==============
allow init_t container_var_run_t:sock_file mounton;

This was generated from ausearch -ts recent | grep -i hawser | audit2allow -M hawser but seems reasonable and looks valid to me. Also, it works for me.