Red Hat Bugzilla – Bug 1298568
SELinux policy for emptyDir volume
Last modified: 2016-07-05 02:23:44 EDT
Description of problem:
If you create pod with volume, where volume is emptyDir, SELinux is blocking access to that directory inside container.
# cat busybox.yaml
- image: busybox
- name: storage
- name: storage
# kubectl get pods
NAME READY STATUS RESTARTS AGE
busybox 1/1 Running 0 40s
# kubectl exec -it busybox /bin/sh
/ # cd /storage/
/storage # touch hello
touch: hello: Permission denied
It is quite pain to work with emptyDir as volumes inside kubenetes pod, you have to always think of chcon. When you stop pod it is recreated with new uid, so you have to chcon emptyDir volumes again :-(
I think, if developer defined a mounted path himself it is ok to require manual chcon, but with emptyDir that should be automatic.
Version-Release number of selected component (if applicable):
# rpm -qa | grep kubernetes
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.2 (Maipo)
Everytime, Try to create pod using template example and then access mounted directory, you will get permission denied issue.
Steps to Reproduce:
1. Create pod template with emptyDir as volumes
2. Deploy pod using kubectl
3. Try to create any file in mounted volume once pod is running by accessing pod container.
It should not provide permission denined issue.
ADB upstream issue: https://github.com/projectatomic/adb-atomic-developer-bundle/issues/117
ADB upstream came with the following solution based on Security Context work :
Once set on a pod level, the EmptyDir volume directory is correctly labeled.
Praveen, is there anything else that needs to be fixed on kubernetes side?
(In reply to Jan Chaloupka from comment #2)
> ADB upstream came with the following solution based on Security Context work
> level: "s0:c123,c456"
> Once set on a pod level, the EmptyDir volume directory is correctly labeled.
> Praveen, is there anything else that needs to be fixed on kubernetes side?
I didn't try latest kubernetes packages yet but ADB upstream solved this issue by putting steps in documents. I am going to close this issue.