Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Relabel containerenv files #5484

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
openshift-merge-robot merged 1 commit into from
Dec 3, 2021
Merged

Relabel containerenv files #5484

openshift-merge-robot merged 1 commit into from
Dec 3, 2021

Conversation

@gkurz
Copy link
Contributor

@gkurz gkurz commented Dec 2, 2021

What type of PR is this?

/kind bug

What this PR does / why we need it:

This adds a relabelling of the containerenv file that is missing in #5463. This is needed to run kata-containers on an SELinux enabled host.

Which issue(s) this PR fixes:

Fixes #5483

Special notes for your reviewer:

Change comes from code inspection. I haven't had time to try this fix yet but I'm proposing it anyway for review, as it is currently blocking our downstream workflow.

Does this PR introduce a user-facing change?

None

@gkurz gkurz requested review from mrunalp and runcom as code owners December 2, 2021 11:41
@openshift-ci openshift-ci bot added release-note-none Denotes a PR that doesn't merit a release note. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/bug Categorizes issue or PR as related to a bug. labels Dec 2, 2021
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Dec 2, 2021

Hi @gkurz. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 2, 2021
@openshift-ci openshift-ci bot requested review from fidencio and rhatdan December 2, 2021 11:41
@fidencio
Copy link
Contributor

fidencio commented Dec 2, 2021

Let me do some local tests here, but it should be fairly straight forward to test on your downstream.

@codecov
Copy link

codecov bot commented Dec 2, 2021 •
edited
Loading

Codecov Report

Merging #5484 (270afcc) into main (1e2f62a) will decrease coverage by 0.00%.
The diff coverage is 0.00%.

❗ Current head 270afcc differs from pull request most recent head 3162e05. Consider uploading reports for the commit 3162e05 to get more accurate results

@@            Coverage Diff             @@
##             main    #5484      +/-   ##
==========================================
- Coverage   43.49%   43.48%   -0.01%     
==========================================
  Files         120      120              
  Lines       11909    11911       +2     
==========================================
  Hits         5180     5180              
- Misses       6237     6239       +2     
  Partials      492      492

@fidencio fidencio self-assigned this Dec 2, 2021
@fidencio
Copy link
Contributor

fidencio commented Dec 2, 2021

@gkurz, may I also ask you to share the error you're facing?
The output of oc describe pod $podname would be very much welcome.

@haircommander haircommander added this to the 1.23 milestone Dec 2, 2021
@haircommander
Copy link
Member

haircommander commented Dec 2, 2021

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 2, 2021
@fidencio
Copy link
Contributor

fidencio commented Dec 2, 2021

/ok-to-test

@fidencio
Copy link
Contributor

fidencio commented Dec 2, 2021

Running with 1e2f62a I can see the following error happening:

Events:
  Type     Reason     Age                   From               Message
  ----     ------     ----                  ----               -------
  Normal   Scheduled  13m                   default-scheduler  Successfully assigned default/nginx to centos
  Warning  Failed     10m (x12 over 13m)    kubelet            Error: CreateContainer failed: Permission denied (os error 13): unknown

And looking at the AVC:

time->Thu Dec  2 15:48:39 2021
type=PROCTITLE msg=audit(1638460119.594:9168): proctitle=2F7573722F6C6962657865632F6B6174612D71656D752F76697274696F667364002D2D7379736C6F67002D6F0063616368653D6175746F002D6F006E6F5F706F7369785F6C6F636B002D6F00736F757263653D2F72756E2F6B6174612D636F6E7461696E6572732F7368617265642F73616E64626F7865732F31393264323362
type=SYSCALL msg=audit(1638460119.594:9168): arch=c000003e syscall=262 success=no exit=-13 a0=2a1 a1=7fbd5516ca79 a2=7fbcceffca00 a3=1100 items=0 ppid=190783 pid=190791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pool" exe="/usr/libexec/kata-qemu/virtiofsd" subj=system_u:system_r:container_kvm_t:s0:c645,c719 key=(null)
type=AVC msg=audit(1638460119.594:9168): avc:  denied  { getattr } for  pid=190791 comm="pool" path="/6a75cf9f9cf706b1ed0dc5eee91831bea5eb2911d1b8526ee7a6f64586a9f361-b204284ea4f1f3a1-.containerenv" dev="vda1" ino=5718410 scontext=system_u:system_r:container_kvm_t:s0:c645,c719 tcontext=system_u:object_r:container_var_lib_t:s0 tclass=file permissive=0

With Greg's patch applied everything work as expected.

@fidencio
Copy link
Contributor

fidencio commented Dec 2, 2021

@gkurz, you may want to add parts of #5484 (comment) in your commit message (I'd suggest doing so).

I'll approve after hearing back from you on what's your preference (to change the commit message or to keep it as it is).

@gkurz
Relabel containerenv files
3162e05 
Running with 1e2f62a the following error happens when creating a POD:

Events:
  Type     Reason     Age                   From               Message
  ----     ------     ----                  ----               -------
  Normal   Scheduled  13m                   default-scheduler  Successfully assigned default/nginx to centos
  Warning  Failed     10m (x12 over 13m)    kubelet            Error: CreateContainer failed: Permission denied (os error 13): unknown

This is paired with the following AVC on the host:

time->Thu Dec  2 15:48:39 2021
type=PROCTITLE msg=audit(1638460119.594:9168): proctitle=2F7573722F6C6962657865632F6B6174612D71656D752F76697274696F667364002D2D7379736C6F67002D6F0063616368653D6175746F002D6F006E6F5F706F7369785F6C6F636B002D6F00736F757263653D2F72756E2F6B6174612D636F6E7461696E6572732F7368617265642F73616E64626F7865732F31393264323362
type=SYSCALL msg=audit(1638460119.594:9168): arch=c000003e syscall=262 success=no exit=-13 a0=2a1 a1=7fbd5516ca79 a2=7fbcceffca00 a3=1100 items=0 ppid=190783 pid=190791 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pool" exe="/usr/libexec/kata-qemu/virtiofsd" subj=system_u:system_r:container_kvm_t:s0:c645,c719 key=(null)
type=AVC msg=audit(1638460119.594:9168): avc:  denied  { getattr } for  pid=190791 comm="pool" path="/6a75cf9f9cf706b1ed0dc5eee91831bea5eb2911d1b8526ee7a6f64586a9f361-b204284ea4f1f3a1-.containerenv" dev="vda1" ino=5718410 scontext=system_u:system_r:container_kvm_t:s0:c645,c719 tcontext=system_u:object_r:container_var_lib_t:s0 tclass=file permissive=0

As it is already done for 'hostname' and 'resolv.conf', apply proper
security labels so that the containerenv file is accessible in
environments that require it, e.g. kata-containers under SELinux.

Fixes cri-o#5843

Tested-by: Fabiano Fidêncio <[email protected]>
Signed-off-by: Greg Kurz <[email protected]>
@gkurz gkurz force-pushed the relabel-containerenv branch from 432340f to 3162e05 Compare December 2, 2021 16:06
@fidencio
Copy link
Contributor

fidencio commented Dec 2, 2021

LGTM

@haircommander, mind to also take a look?

@umohnani8
Copy link
Member

umohnani8 commented Dec 2, 2021

LGTM
@rhatdan @haircommander PTAL

@haircommander
Copy link
Member

haircommander commented Dec 2, 2021

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 2, 2021
@haircommander
Copy link
Member

haircommander commented Dec 2, 2021

/approve

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Dec 2, 2021

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gkurz, haircommander

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 2, 2021
@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

10 similar comments
@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link

openshift-bot commented Dec 2, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Dec 3, 2021 •
edited
Loading

@gkurz: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/openshift-jenkins/integration_crun_cgroupv2 3162e05 link false /test integration_cgroupv2
ci/openshift-jenkins/e2e_crun_cgroupv2 3162e05 link false /test e2e_cgroupv2

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-bot
Copy link

openshift-bot commented Dec 3, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

1 similar comment
@openshift-bot
Copy link

openshift-bot commented Dec 3, 2021

/retest-required

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit 367232b into cri-o:main Dec 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@runcom runcom Awaiting requested review from runcom

@fidencio fidencio Awaiting requested review from fidencio

@rhatdan rhatdan Awaiting requested review from rhatdan

Assignees

@fidencio fidencio

@haircommander haircommander

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/bug Categorizes issue or PR as related to a bug. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesn't merit a release note.

Projects

None yet

Milestone

1.23

Development

Successfully merging this pull request may close these issues.

Relabelling is needed for /run/.containerenv

6 participants

@gkurz @fidencio @haircommander @umohnani8 @openshift-bot @openshift-merge-robot