@Jan Will CSI do any modification of the SELinux policy of OCP hosts to enable the use of Ceph?  Or should the boolean be on for RHCOS/OCP nodes?

container_use_cephs is not defined in container-selinux.

$ sesearch -A --bool container_use_cephfs
allow container_domain fs_t:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink write }; [ container_use_cephfs ]:True
allow container_domain fs_t:dir { add_name getattr ioctl lock open read remove_name search write }; [ container_use_cephfs ]:True
allow container_domain fs_t:dir { add_name getattr ioctl lock open read remove_name search write }; [ container_use_cephfs ]:True
allow container_domain fs_t:dir { add_name getattr ioctl lock open read remove_name search write }; [ container_use_cephfs ]:True
allow container_domain fs_t:dir { getattr open search }; [ container_use_cephfs ]:True
allow container_domain fs_t:file { append create getattr ioctl link lock open read rename setattr unlink write }; [ container_use_cephfs ]:True
allow container_domain fs_t:file { execute execute_no_trans getattr ioctl map open read }; [ container_use_cephfs ]:True
allow container_domain fs_t:lnk_file { append create getattr ioctl link lock read rename setattr unlink write }; [ container_use_cephfs ]:True

This looks like we don't have proper labels on cephfs_t?

Dan,

I see container_use_cephfs defined in container-selinux:

## <desc>
##  <p>
##  Determine whether container can
##  use ceph file system
##  </p>
## </desc>
gen_tunable(container_use_cephfs, false)

It was added to Fedora a year ago:

commit bf9e3528d1c7ade2fa01b90a3474ee304308cfe5
Author: Daniel J Walsh <dwalsh>
Date:   Wed Mar 27 06:37:58 2019 -0400

    Add boolean to allow containers to use ceph file systems

and it seems to be present in RHEL 8.1.

What did you mean with "we don't have proper labels on cephfs_t?"

I spelled it wrong.  You are right.  

Micah , you think this was enabled by default at one time?

OK, switching the component back to container-selinux.

@Dan, you are right; the boolean was never enabled by default. 

I misunderstood what was changed in BZ#1692369.  The boolean was *added* to the policy in that BZ, but was off by default.  However, RHCOS introduced a change to turn that boolean on by default.

Closing as NOTABUG.