fix(kube): gate SELinux volume warning note on host SELinux state by i-OmSharma · Pull Request #29230 · podman-container-tools/podman

i-OmSharma · 2026-07-20T18:28:27Z

podman kube generate always printed a NOTE about SELinux volume
permissions whenever a pod had volumes, even on non-SELinux hosts or
rootful setups. This added noise for most users.

This gates the warning so it only fires when it's actually relevant:
volumes exist AND SELinux is enabled on the host AND podman is running
rootless. The condition is inlined directly at the call site.

Coverage is added to the existing "with volume" e2e case in
generate_kube_test.go, checking the note shows up only when running
rootless with selinux enabled.

Copilot

Pull request overview

This PR updates podman kube generate (ABI/local implementation) to avoid emitting the SELinux volume-permissions NOTE comment unless the host reports SELinux as enabled, reducing noise in generated Kubernetes YAML on non-SELinux systems.

Changes:

Import github.com/opencontainers/selinux/go-selinux in the ABI kube generator.
Gate rendering of the SELinux volume warning NOTE on selinux.GetEnabled() in addition to len(po.Spec.Volumes) != 0.

Comments suppressed due to low confidence (1)

pkg/domain/infra/abi/generate.go:226

The NOTE text is explicitly scoped to “unprivileged and rootless” usage, but the new gating only checks host SELinux state. On SELinux-enabled hosts this will still emit the NOTE for rootful/privileged runs, which makes the rendered output misleading/noisy.

Consider either (a) also gating the NOTE on rootless/unprivileged state, or (b) rewording the NOTE to match the broader condition.

		if len(po.Spec.Volumes) != 0 && selinux.GetEnabled() {
			warning := `
# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux
# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container
# has the right permissions to access the volumes added.

i-OmSharma · 2026-07-20T18:46:39Z

 			return nil, err
 		}
-		if len(po.Spec.Volumes) != 0 {
+		if len(po.Spec.Volumes) != 0 && selinux.GetEnabled() {


Fixed in the latest amended commit by coupling rootless.IsRootless() and introducing native regression tests in generate_test.go.

i-OmSharma · 2026-07-21T07:06:42Z

@Luap99 could you take a look when you get a chance? Small, fully-tested
fix for #17743 (SELinux volume warning noise in kube generate). CI is
green across all checks.

Luap99

As a more general not I do not know why the man page and the warning special cases rootless podman, selinux labelling applies to the rootful containers in the same way but I guess this is unrelated to this change itself

Luap99 · 2026-07-21T16:41:38Z

+// selinuxGetEnabled and rootlessIsRootless are indirections over selinux.GetEnabled
+// and rootless.IsRootless so tests can override them.
+var (
+	selinuxGetEnabled  = selinux.GetEnabled
+	rootlessIsRootless = rootless.IsRootless
+)


I don't see the point in doing this it just complicated the code a bit for no benefit unit testing two bool conditions is rather pointless.

Removed the vars and the helper, just inlined the check directly now.

Luap99 · 2026-07-21T16:46:31Z

+
+import "testing"
+
+func TestShouldWarnSELinuxVolumes(t *testing.T) {


I would just delete the test, testing a one line boolean condition like that does notto really seem to help us.

Instead we should just have a e2e test case here test/e2e/generate_kube_test.go, ideally instead of adding yet another case there just piggy back onto an existing generate command with volumes, i.e. in "with volume"
and then just check the string is in the output only as rootless user and when selnix is enabled.

ok, i have dropped the unit test and added the check to the existing "with volume" e2e case instead — it verifies the note only shows up when running rootless with selinux enabled.

i-OmSharma · 2026-07-22T07:58:03Z

As a more general not I do not know why the man page and the warning special cases rootless podman, selinux labelling applies to the rootful containers in the same way but I guess this is unrelated to this change itself

I noticed that too while digging into it. The man page only mentions rootless so I kept the behavior matching that for now, didn't want to change the scope here. Can open a separate issue for the rootful case if you think it's worth looking into.

i-OmSharma · 2026-07-22T07:58:23Z

Thanks for the review @Luap99. Made both changes — inlined the condition and swapped the unit test for e2e coverage in the "with volume" case. Let me know if there's anything else.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

i-OmSharma · 2026-07-22T08:53:27Z

+		if isRootless() && selinux.GetEnabled() {
+			Expect(string(b)).To(ContainSubstring("check the podman generate kube man page"))
+		} else {
+			Expect(string(b)).NotTo(ContainSubstring("check the podman generate kube man page"))
+		}


The assertion was sitting on the pod-generation path where the note isn't emitted — moved it to a new case that generates from a standalone container with a volume, so the gating actually gets exercised now.

The SELinux volume-permissions NOTE only applies to unprivileged, rootless containers on an SELinux-enabled host. Emit it only when both conditions hold, instead of on every volume-bearing object. Add an e2e case generating from a standalone container with a volume, asserting the NOTE appears only when rootless and SELinux is enabled. Fixes: podman-container-tools#17743 Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>

i-OmSharma · 2026-07-22T08:59:13Z

@Luap99 heads up — the existing "with volume" case generates from a pod, and the note only emits on the container path, so I added a separate container-based case for the assertion instead of piggybacking on that one. Everything else is as you suggested.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

mheon

LGTM

TomSweeneyRedHat · 2026-07-23T21:33:17Z

LGTM
I'd like @Luap99 to give this one more look over.
Thanks @i-OmSharma!

danishprakash · 2026-07-24T07:41:40Z

+		session := podmanTest.Podman([]string{"run", "-d", "--name", ctrName, "-v", vol1 + ":/volume/:z", CITEST_IMAGE, "top"})
+		session.WaitWithDefaultTimeout()
+		Expect(session).Should(ExitCleanly())


nit: no need to run the container, create should suffice:

Suggested change

session := podmanTest.Podman([]string{"run", "-d", "--name", ctrName, "-v", vol1 + ":/volume/:z", CITEST_IMAGE, "top"})

session.WaitWithDefaultTimeout()

Expect(session).Should(ExitCleanly())

session := podmanTest.PodmanExitCleanly([]string{"create", "--name", ctrName, "-v", vol1 + ":/volume/:z", CITEST_IMAGE})

Luap99

LGTM

Copilot AI review requested due to automatic review settings July 20, 2026 18:28

Copilot started reviewing on behalf of i-OmSharma July 20, 2026 18:29 View session

Copilot AI reviewed Jul 20, 2026

View reviewed changes

i-OmSharma force-pushed the fix-kube-generate-selinux-note branch from fab9048 to ecf3bf8 Compare July 20, 2026 18:40

Luap99 requested changes Jul 21, 2026

View reviewed changes

i-OmSharma force-pushed the fix-kube-generate-selinux-note branch from ecf3bf8 to dbbfab8 Compare July 22, 2026 07:46

i-OmSharma requested review from Luap99 and Copilot July 22, 2026 08:00

Copilot started reviewing on behalf of i-OmSharma July 22, 2026 08:01 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

i-OmSharma force-pushed the fix-kube-generate-selinux-note branch from dbbfab8 to cfd3a3f Compare July 22, 2026 08:52

i-OmSharma requested a review from Copilot July 22, 2026 09:00

Copilot started reviewing on behalf of i-OmSharma July 22, 2026 09:00 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

mheon approved these changes Jul 23, 2026

View reviewed changes

danishprakash reviewed Jul 24, 2026

View reviewed changes

Luap99 approved these changes Jul 24, 2026

View reviewed changes

Luap99 merged commit cc8c07d into podman-container-tools:main Jul 24, 2026
70 checks passed


		import "testing"

		func TestShouldWarnSELinuxVolumes(t *testing.T) {

Uh oh!

Conversation

i-OmSharma commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

i-OmSharma Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

i-OmSharma commented Jul 21, 2026

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Luap99 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

i-OmSharma Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Luap99 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

i-OmSharma Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

i-OmSharma commented Jul 22, 2026

Uh oh!

i-OmSharma commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

i-OmSharma Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

i-OmSharma commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mheon left a comment

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat commented Jul 23, 2026

Uh oh!

danishprakash Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

i-OmSharma commented Jul 20, 2026 •

edited

Loading

i-OmSharma Jul 22, 2026 •

edited

Loading

danishprakash Jul 24, 2026 •

edited

Loading