2086098 – [4.8] conditionally relabel volumes given annotation not working - SELinux context match is wrong

Bug 2086098 - [4.8] conditionally relabel volumes given annotation not working - SELinux context match is wrong

Summary: [4.8] conditionally relabel volumes given annotation not working - SELinux co...

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Node
Sub Component:
Version:	4.8
Hardware:	Unspecified
OS:	Unspecified
Priority:	medium
Severity:	high
Target Milestone:	---
Target Release:	4.8.z
Assignee:	Peter Hunt
QA Contact:	Sunil Choudhary
Docs Contact:
URL:
Whiteboard:
Depends On:	2071033 2079454 2079461
Blocks:
TreeView+	depends on / blocked

Reported:	2022-05-13 20:17 UTC by Peter Hunt
Modified:	2022-06-16 18:23 UTC (History)
CC List:	7 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:	2079461
Environment:
Last Closed:	2022-06-16 18:23:49 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Github	cri-o cri-o pull 5873	0	None	open	[release-1.21] [release-1.23] server: Canonize selinux label for comparison with filesystem label	2022-05-13 20:18:22 UTC
Red Hat Product Errata	RHBA-2022:4952	0	None	None	None	2022-06-16 18:23:57 UTC

Comment 7 Sunil Choudhary 2022-06-13 17:12:42 UTC

% oc get clusterversion
NAME      VERSION   AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.8.43    True        False         8h      Cluster version is 4.8.43

% oc create -f mcs.yaml 
machineconfig.machineconfiguration.openshift.io/99-worker-selinux-configuration created

% oc get mc
NAME                                               GENERATEDBYCONTROLLER                      IGNITIONVERSION   AGE
00-master                                          58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
00-worker                                          58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
01-master-container-runtime                        58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
01-master-kubelet                                  58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
01-worker-container-runtime                        58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
01-worker-kubelet                                  58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
99-master-generated-registries                     58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
99-master-ssh                                                                                 3.2.0             8h
99-worker-generated-registries                     58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
99-worker-selinux-configuration                                                               3.2.0             11s
99-worker-ssh                                                                                 3.2.0             8h
rendered-master-f0582fa726ab9ab4399e3422720d5f08   58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h
rendered-worker-57ee6efa2cd55c1a2a607d15292cc14b   58e73629d83330deae8b829b890b004de22b836b   3.2.0             6s
rendered-worker-a914e4461e221c03f4af8315ccd1ecc5   58e73629d83330deae8b829b890b004de22b836b   3.2.0             8h

% oc get nodes
NAME                                        STATUS                     ROLES    AGE   VERSION
zhsunvs-wrz9b-master-0                      Ready                      master   8h    v1.21.11+6b3cbdd
zhsunvs-wrz9b-master-1                      Ready                      master   8h    v1.21.11+6b3cbdd
zhsunvs-wrz9b-master-2                      Ready                      master   8h    v1.21.11+6b3cbdd
zhsunvs-wrz9b-worker-northcentralus-5pcjr   Ready                      worker   8h    v1.21.11+6b3cbdd
zhsunvs-wrz9b-worker-northcentralus-fr6wj   Ready,SchedulingDisabled   worker   8h    v1.21.11+6b3cbdd
zhsunvs-wrz9b-worker-northcentralus-m6zc6   Ready                      worker   8h    v1.21.11+6b3cbdd

% oc create -f rc.yaml 
runtimeclass.node.k8s.io/selinux created


% oc create -f pv.yaml
persistentvolume/pv0001 created

oc create -f pvc.yaml
persistentvolumeclaim/myclaim created


oc create -f deploy.yaml
deployment.apps/pv-deploy created

% oc get pods -o wide
NAME                         READY   STATUS    RESTARTS   AGE   IP           NODE                                        NOMINATED NODE   READINESS GATES
pv-deploy-7d5f79cb7f-qh799   1/1     Running   0          14s   10.128.2.7   zhsunvs-wrz9b-worker-northcentralus-m6zc6   <none>           <none>


sh-4.4# runc list | grep -i 694946f7bdfb5
694946f7bdfb58921fd2474dd8d6bacc58807441256dfeb928c88e9830d125b7   11098       running     /run/containers/storage/overlay-containers/694946f7bdfb58921fd2474dd8d6bacc58807441256dfeb928c88e9830d125b7/userdata   2022-06-13T16:59:59.060839932Z   root


sh-4.4# ls -lZ /run/containers/storage/overlay-containers/694946f7bdfb58921fd2474dd8d6bacc58807441256dfeb928c88e9830d125b7/userdata/config.json
-rw-r--r--. 1 root root system_u:object_r:unlabeled_t:s0 30901 Jun 13 16:59 /run/containers/storage/overlay-containers/694946f7bdfb58921fd2474dd8d6bacc58807441256dfeb928c88e9830d125b7/userdata/config.json

Comment 9 errata-xmlrpc 2022-06-16 18:23:49 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.8.43 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:4952

Note You need to log in before you can comment on or make changes to this bug.