Bug 2043254

Summary:	crio does not bind the security profiles directory
Product:	OpenShift Container Platform	Reporter:	Ryan Phillips <rphillips>
Component:	Node	Assignee:	Ryan Phillips <rphillips>
Node sub component:	CRI-O	QA Contact:	Sunil Choudhary <schoudha>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	urgent
Priority:	unspecified	CC:	aos-bugs, nagrawal
Version:	4.6.z
Target Milestone:	---
Target Release:	4.10.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-10 16:41:21 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ryan Phillips 2022-01-20 22:09:18 UTC

Description of problem:
crio checks for the security profiles path, but uses the incorrect root. This results in the security profiles directory to not be bound to the right /etc path.

Version-Release number of selected component (if applicable):
4.6, 4.7, 4.8, 4.9, 4.10

How reproducible:
All the time

Comment 5 Sunil Choudhary 2022-02-11 07:07:35 UTC

Verified on 4.10.0-0.nightly-2022-02-10-161006

$ oc get clusterversion
NAME      VERSION                              AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.10.0-0.nightly-2022-02-10-161006   True        False         24m     Cluster version is 4.10.0-0.nightly-2022-02-10-161006

$ oc get nodes
NAME                                         STATUS   ROLES    AGE   VERSION
ip-10-0-140-249.us-east-2.compute.internal   Ready    master   38m   v1.23.3+759c22b
ip-10-0-148-137.us-east-2.compute.internal   Ready    worker   30m   v1.23.3+759c22b
ip-10-0-168-62.us-east-2.compute.internal    Ready    master   37m   v1.23.3+759c22b
ip-10-0-170-55.us-east-2.compute.internal    Ready    worker   30m   v1.23.3+759c22b
ip-10-0-194-233.us-east-2.compute.internal   Ready    worker   29m   v1.23.3+759c22b
ip-10-0-201-65.us-east-2.compute.internal    Ready    master   38m   v1.23.3+759c22b

$ oc debug node/ip-10-0-148-137.us-east-2.compute.internal
Starting pod/ip-10-0-148-137us-east-2computeinternal-debug ...
...


sh-4.4# crictl ps | grep -i router
07504abadafea       quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:0320135a52d557f26e5e7311c2254a46132a4ed59699d0bbd52aed987aba243c   30 minutes ago      Running             router                               0                   cda0ba3f545d4

sh-4.4# crictl exec -ti 07504abadafea /bin/sh
sh-4.4$ mount | grep -i crypto
overlay on /etc/crypto-policies/back-ends type overlay (rw,relatime,context="system_u:object_r:container_file_t:s0:c14,c24",lowerdir=/var/lib/containers/storage/overlay/l/7GVLOXXEZTRNEG5R7WWMRAJCFH:/var/lib/containers/storage/overlay/l/KOTWLEZMC5C64JFBOQCZLEBW2V:/var/lib/containers/storage/overlay/l/3J3MXQXKBADJRKEAGTWVSSCSFX:/var/lib/containers/storage/overlay/l/77RJT7UA4EFNIKHZQOD2WRZ6Q4:/var/lib/containers/storage/overlay/l/5KAIN2PNI24Q6JS25BXXVHF5GS:/var/lib/containers/storage/overlay/l/7DOOJV3P45L7NNZIO4ZLFKZNSR,upperdir=/var/lib/containers/storage/overlay/bff2f73fc1c64208b821088bce7cdefc22c78ec5e3911c2af502cc0e32ea37d2/diff,workdir=/var/lib/containers/storage/overlay/bff2f73fc1c64208b821088bce7cdefc22c78ec5e3911c2af502cc0e32ea37d2/work)
sh-4.4$

Comment 7 errata-xmlrpc 2022-03-10 16:41:21 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:0056