Red Hat Bugzilla – Bug 1450167
Upgrade needs to remove "svirt_sandbox_file_t" from openshift.local.volumes
Last modified: 2017-08-16 15:51 EDT
+++ This bug was initially created as a clone of Bug #1421738 +++ Description of problem: As card https://trello.com/c/BGFPBpeF rebased to 3.5, the label "svirt_sandbox_file_t" on /var/lib/origin/openshift.local.volumes/ is no longer necessary. need remove it make selinux more secure. Version-Release number of selected component (if applicable): openshift v3.5.0.19+199197c kubernetes v1.5.2+43a9be4 etcd 3.1.0 How reproducible: Always Steps to Reproduce: 1. Set ocp-3.5 env and on node check selinux context of '/var/lib/origin/openshift.local.volumes/' [root@host-8-174-53 ~]# ls -ldZ /var/lib/origin/openshift.local.volumes/ drwxr-x---. root root system_u:object_r:svirt_sandbox_file_t:s0 /var/lib/origin/openshift.local.volumes/ Actual results: Expected results: 1. /var/lib/origin/openshift.local.volumes/ shouldn't have "svirt_sandbox_file_t" label Additional info: --- Additional comment from Eric Paris on 2017-02-13 14:25:56 EST --- https://github.com/openshift/origin/pull/12942 Although I am going to call this 'upcoming release' and target 3.6. I am unwilling to destabalize 3.5 at this point when we've worked this way so long. --- Additional comment from Derek Carr on 2017-03-29 10:07:32 EDT --- we will fix this after the rebase lands. --- Additional comment from Derek Carr on 2017-04-20 15:58:02 EDT --- rebase not yet landed.
This clone is to have the installer reset the context of /var/lib/origin/openshift.local.volumes during upgrades https://github.com/openshift/openshift-ansible/pull/4165
Verified and pass. The label is as following [root@host3-ha-1 ~]# ls -laZ /var/lib/origin/openshift.local.volumes/ drwxr-x---. root root system_u:object_r:svirt_sandbox_file_t:s0 . drwxr-xr-x. root root unconfined_u:object_r:var_lib_t:s0 .. drwxr-x---. root root system_u:object_r:var_lib_t:s0 plugins drwxr-x---. root root system_u:object_r:var_lib_t:s0 pods
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1716