Bug 1298568 - SELinux policy for emptyDir volume
SELinux policy for emptyDir volume
Status: CLOSED WORKSFORME
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: kubernetes (Show other bugs)
7.2
Unspecified Unspecified
unspecified Severity medium
: rc
: ---
Assigned To: Jan Chaloupka
atomic-bugs@redhat.com
: Extras
Depends On:
Blocks: 1186913
  Show dependency treegraph
 
Reported: 2016-01-14 07:56 EST by Praveen Kumar
Modified: 2016-07-05 02:23 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-07-05 02:23:44 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 2130341 None None None 2016-06-15 14:44 EDT

  None (edit)
Description Praveen Kumar 2016-01-14 07:56:49 EST
Description of problem:
If you create pod with volume, where volume is emptyDir, SELinux is blocking access to that directory inside container.

Example
# cat busybox.yaml
apiVersion: v1
kind: Pod
metadata:
  name: busybox
  namespace: default
spec:
  containers:
  - image: busybox
    name: busybox
    command:
      - sleep
      - "36000"
    volumeMounts:
      - name: storage
        mountPath: /storage
  volumes:
    - name: storage
      emptyDir: {}

# kubectl get pods
NAME      READY     STATUS    RESTARTS   AGE
busybox   1/1       Running   0          40s

# kubectl exec -it busybox /bin/sh
/ # cd /storage/
/storage # touch hello
touch: hello: Permission denied

It is quite pain to work with emptyDir as volumes inside kubenetes pod, you have to always think of chcon. When you stop pod it is recreated with new uid, so you have to chcon emptyDir volumes again :-(

I think, if developer defined a mounted path himself it is ok to require manual chcon, but with emptyDir that should be automatic.

Version-Release number of selected component (if applicable):

# rpm -qa | grep kubernetes
kubernetes-master-1.0.3-0.2.gitb9a88a7.el7.x86_64
kubernetes-client-1.0.3-0.2.gitb9a88a7.el7.x86_64
kubernetes-node-1.0.3-0.2.gitb9a88a7.el7.x86_64
kubernetes-1.0.3-0.2.gitb9a88a7.el7.x86_64

# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.2 (Maipo)

How reproducible:
Everytime, Try to create pod using template example and then access mounted directory, you will get permission denied issue.


Steps to Reproduce:
1. Create pod template with emptyDir as volumes
2. Deploy pod using kubectl
3. Try to create any file in mounted volume once pod is running by accessing pod container.

Actual results:
Permission denied 

Expected results:

It should not provide permission denined issue.

Additional info:

ADB upstream issue: https://github.com/projectatomic/adb-atomic-developer-bundle/issues/117
Comment 2 Jan Chaloupka 2016-06-17 07:54:52 EDT
ADB upstream came with the following solution based on Security Context work [1]:

    securityContext:
      seLinuxOptions:
         level: "s0:c123,c456"

Once set on a pod level, the EmptyDir volume directory is correctly labeled.

[1] https://github.com/projectatomic/adb-atomic-developer-bundle/issues/117#issuecomment-215313573

Praveen, is there anything else that needs to be fixed on kubernetes side?
Comment 3 Praveen Kumar 2016-07-05 02:22:52 EDT
(In reply to Jan Chaloupka from comment #2)
> ADB upstream came with the following solution based on Security Context work
> [1]:
> 
>     securityContext:
>       seLinuxOptions:
>          level: "s0:c123,c456"
> 
> Once set on a pod level, the EmptyDir volume directory is correctly labeled.
> 
> [1]
> https://github.com/projectatomic/adb-atomic-developer-bundle/issues/
> 117#issuecomment-215313573
> 
> Praveen, is there anything else that needs to be fixed on kubernetes side?

I didn't try latest kubernetes packages yet but ADB upstream solved this issue by putting steps in documents. I am going to close this issue.

Note You need to log in before you can comment on or make changes to this bug.