Bug 1808187

Summary:	container_use_cephfs regressed to disabled?
Product:	Red Hat Enterprise Linux 8	Reporter:	Micah Abbott <miabbott>
Component:	container-selinux	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED NOTABUG	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.1	CC:	dwalsh, jnovy, jsafrane, lvrabec, mmalik, plautrba, ssekidde
Target Milestone:	rc
Target Release:	8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-03 20:44:47 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Micah Abbott 2020-02-28 03:11:37 UTC

In BZ#1692369 it was requested that the `container_use_cephfs` boolean be enabled by default in the `container-selinux` policy file.

The BZ was verified with version 2.94 (https://bugzilla.redhat.com/show_bug.cgi?id=1692369#c12)

While unwinding some SELinux policy changes being made on RHCOS, it was observed that version 2.124 has the boolean disabled.

```
$ rpm -q container-selinux
container-selinux-2.124.0-1.module+el8.1.1+5259+bcdd613a.noarch
$ getsebool container_use_cephfs
container_use_cephfs --> off
```

Comment 1 Micah Abbott 2020-02-28 03:13:25 UTC

@Jan Will CSI do any modification of the SELinux policy of OCP hosts to enable the use of Ceph?  Or should the boolean be on for RHCOS/OCP nodes?

Comment 2 Daniel Walsh 2020-03-02 14:36:53 UTC

container_use_cephs is not defined in container-selinux.

$ sesearch -A --bool container_use_cephfs
allow container_domain fs_t:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink write }; [ container_use_cephfs ]:True
allow container_domain fs_t:dir { add_name getattr ioctl lock open read remove_name search write }; [ container_use_cephfs ]:True
allow container_domain fs_t:dir { add_name getattr ioctl lock open read remove_name search write }; [ container_use_cephfs ]:True
allow container_domain fs_t:dir { add_name getattr ioctl lock open read remove_name search write }; [ container_use_cephfs ]:True
allow container_domain fs_t:dir { getattr open search }; [ container_use_cephfs ]:True
allow container_domain fs_t:file { append create getattr ioctl link lock open read rename setattr unlink write }; [ container_use_cephfs ]:True
allow container_domain fs_t:file { execute execute_no_trans getattr ioctl map open read }; [ container_use_cephfs ]:True
allow container_domain fs_t:lnk_file { append create getattr ioctl link lock read rename setattr unlink write }; [ container_use_cephfs ]:True

This looks like we don't have proper labels on cephfs_t?

Comment 3 Zdenek Pytela 2020-03-02 15:15:54 UTC

Dan,

I see container_use_cephfs defined in container-selinux:

## <desc>
##  <p>
##  Determine whether container can
##  use ceph file system
##  </p>
## </desc>
gen_tunable(container_use_cephfs, false)

It was added to Fedora a year ago:

commit bf9e3528d1c7ade2fa01b90a3474ee304308cfe5
Author: Daniel J Walsh <dwalsh>
Date:   Wed Mar 27 06:37:58 2019 -0400

    Add boolean to allow containers to use ceph file systems

and it seems to be present in RHEL 8.1.

What did you mean with "we don't have proper labels on cephfs_t?"

Comment 4 Daniel Walsh 2020-03-02 21:51:50 UTC

I spelled it wrong.  You are right.  

Micah , you think this was enabled by default at one time?

Comment 5 Zdenek Pytela 2020-03-03 07:44:03 UTC

OK, switching the component back to container-selinux.

Comment 6 Micah Abbott 2020-03-03 20:44:47 UTC

@Dan, you are right; the boolean was never enabled by default. 

I misunderstood what was changed in BZ#1692369.  The boolean was *added* to the policy in that BZ, but was off by default.  However, RHCOS introduced a change to turn that boolean on by default.

Closing as NOTABUG.