Bug 2043254 - crio does not bind the security profiles directory
Summary: crio does not bind the security profiles directory
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Node
Version: 4.6.z
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
: 4.10.0
Assignee: Ryan Phillips
QA Contact: Sunil Choudhary
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-01-20 22:09 UTC by Ryan Phillips
Modified: 2022-03-10 16:41 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-03-10 16:41:21 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github cri-o cri-o pull 5555 0 None Merged Bug 2043254: pass the main image mount point to fix crypto profiles binding 2022-01-27 16:25:02 UTC
Red Hat Product Errata RHSA-2022:0056 0 None None None 2022-03-10 16:41:37 UTC

Description Ryan Phillips 2022-01-20 22:09:18 UTC
Description of problem:
crio checks for the security profiles path, but uses the incorrect root. This results in the security profiles directory to not be bound to the right /etc path.

Version-Release number of selected component (if applicable):
4.6, 4.7, 4.8, 4.9, 4.10

How reproducible:
All the time

Comment 5 Sunil Choudhary 2022-02-11 07:07:35 UTC
Verified on 4.10.0-0.nightly-2022-02-10-161006

$ oc get clusterversion
NAME      VERSION                              AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.10.0-0.nightly-2022-02-10-161006   True        False         24m     Cluster version is 4.10.0-0.nightly-2022-02-10-161006

$ oc get nodes
NAME                                         STATUS   ROLES    AGE   VERSION
ip-10-0-140-249.us-east-2.compute.internal   Ready    master   38m   v1.23.3+759c22b
ip-10-0-148-137.us-east-2.compute.internal   Ready    worker   30m   v1.23.3+759c22b
ip-10-0-168-62.us-east-2.compute.internal    Ready    master   37m   v1.23.3+759c22b
ip-10-0-170-55.us-east-2.compute.internal    Ready    worker   30m   v1.23.3+759c22b
ip-10-0-194-233.us-east-2.compute.internal   Ready    worker   29m   v1.23.3+759c22b
ip-10-0-201-65.us-east-2.compute.internal    Ready    master   38m   v1.23.3+759c22b

$ oc debug node/ip-10-0-148-137.us-east-2.compute.internal
Starting pod/ip-10-0-148-137us-east-2computeinternal-debug ...
...


sh-4.4# crictl ps | grep -i router
07504abadafea       quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:0320135a52d557f26e5e7311c2254a46132a4ed59699d0bbd52aed987aba243c   30 minutes ago      Running             router                               0                   cda0ba3f545d4

sh-4.4# crictl exec -ti 07504abadafea /bin/sh
sh-4.4$ mount | grep -i crypto
overlay on /etc/crypto-policies/back-ends type overlay (rw,relatime,context="system_u:object_r:container_file_t:s0:c14,c24",lowerdir=/var/lib/containers/storage/overlay/l/7GVLOXXEZTRNEG5R7WWMRAJCFH:/var/lib/containers/storage/overlay/l/KOTWLEZMC5C64JFBOQCZLEBW2V:/var/lib/containers/storage/overlay/l/3J3MXQXKBADJRKEAGTWVSSCSFX:/var/lib/containers/storage/overlay/l/77RJT7UA4EFNIKHZQOD2WRZ6Q4:/var/lib/containers/storage/overlay/l/5KAIN2PNI24Q6JS25BXXVHF5GS:/var/lib/containers/storage/overlay/l/7DOOJV3P45L7NNZIO4ZLFKZNSR,upperdir=/var/lib/containers/storage/overlay/bff2f73fc1c64208b821088bce7cdefc22c78ec5e3911c2af502cc0e32ea37d2/diff,workdir=/var/lib/containers/storage/overlay/bff2f73fc1c64208b821088bce7cdefc22c78ec5e3911c2af502cc0e32ea37d2/work)
sh-4.4$

Comment 7 errata-xmlrpc 2022-03-10 16:41:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:0056


Note You need to log in before you can comment on or make changes to this bug.