Red Hat Bugzilla – Bug 1421738
Need remove "svirt_sandbox_file_t" from openshift.local.volumes
Last modified: 2017-08-16 15:51 EDT
Description of problem: As card https://trello.com/c/BGFPBpeF rebased to 3.5, the label "svirt_sandbox_file_t" on /var/lib/origin/openshift.local.volumes/ is no longer necessary. need remove it make selinux more secure. Version-Release number of selected component (if applicable): openshift v3.5.0.19+199197c kubernetes v1.5.2+43a9be4 etcd 3.1.0 How reproducible: Always Steps to Reproduce: 1. Set ocp-3.5 env and on node check selinux context of '/var/lib/origin/openshift.local.volumes/' [root@host-8-174-53 ~]# ls -ldZ /var/lib/origin/openshift.local.volumes/ drwxr-x---. root root system_u:object_r:svirt_sandbox_file_t:s0 /var/lib/origin/openshift.local.volumes/ Actual results: Expected results: 1. /var/lib/origin/openshift.local.volumes/ shouldn't have "svirt_sandbox_file_t" label Additional info:
https://github.com/openshift/origin/pull/12942 Although I am going to call this 'upcoming release' and target 3.6. I am unwilling to destabalize 3.5 at this point when we've worked this way so long.
we will fix this after the rebase lands.
rebase not yet landed.
This is a bug fix, but one that may be dangerous and thus I would prefer to do it at the beginning of next sprint instead of the end of this sprint. https://github.com/openshift/origin/pull/12942
Eric - do you want to mark this upcoming release per your previous comment?
Paul, you must review this this week and LGTM. You must be ready to tag on Monday.
Origin merge queue is having issues. Still hits this aos-cd-jobs bug: https://github.com/openshift/aos-cd-jobs/issues/346 Adding UpcomingRelease and Eric will manually merge Monday morning if it hasn't merged by then.
Verify on openshift v3.6.133 [root@qe-public-master-etcd-1 ~]# ls -ldZ /var/lib/origin/openshift.local.volumes/ drwxr-x---. root root system_u:object_r:var_lib_t:s0 /var/lib/origin/openshift.local.volumes/
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1716