Bug 2192323

Summary: Set container storage label on local-path-provisioner
Product: Red Hat Enterprise Linux 9 Reporter: Carroline <cpippin>
Component: container-selinuxAssignee: Daniel Walsh <dwalsh>
Status: CLOSED ERRATA QA Contact: Edward Shen <weshen>
Severity: high Docs Contact:
Priority: unspecified    
Version: 9.1CC: ajia, dornelas, dwalsh, jnovy, lsm5, mboddu, rmanes, tsweeney, weshen
Target Milestone: rcKeywords: Reopened, Triaged
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: container-selinux-2.218.0-1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-11-07 08:24:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Carroline 2023-05-01 11:27:25 UTC
Description of problem:


Version-Release number of selected component (if applicable):

RHEL 9.1

How reproducible:
/{opt,var}/local-path-provisioner are the default paths used for container local storage and should have the correct SELinux label automatically.


Actual results:
- container-selinux does not automatically set the context for local-path-provisioner

Expected results:
- container-selinux should automatically set the context for local-path-provisioner

Additional info:

Comment 2 Daniel Walsh 2023-05-01 13:59:11 UTC
Those are not standard OS paths, so they should be labeled locally by the tool defining them.

You can use semanage and restorecon to set the proper labels.

The upstream container-selinux will not handle these labels.

semanage fcontext -a ...

Comment 6 Daniel Walsh 2023-06-29 20:52:34 UTC
Fixed in container-selinux-2.218.0-1

Comment 14 errata-xmlrpc 2023-11-07 08:24:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (container-selinux bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6328