Add granular control of SELinux labels for host mounts #19839

Juanadelacuesta · 2024-01-29T12:06:18Z

Currently when using the podman task driver plugin if the selinuxlabel = "z" option is present in the volume configuration, all the host volume mounts will be forced to use SELinux shared volume context.

There is no way for operators to use the csi-hostpath plugin or any type of mount that is not compliant with the SELinux security, or mount a private volume. This PR introduces a new configuration option that can be set per volume mount, allowing to set different SELinux context to different volumes.

There will also be a PR on the nomad-driver-podman to read and apply the new configuration.

Closes:

hashicorp-cla · 2024-01-29T12:24:31Z

All committers have signed the CLA.

tgross

LGTM for the jobspec addition. But I think we want to add support for this flag with the docker driver (and maybe exec/java drivers too?) by making sure it's provided to the mounts the driver sets up (ex. driver.go#L1181-L1186)

Also, I think this might close out #9123 too. Probably a good idea to do a quick search thru open issues to see if there are others.

tgross · 2024-01-30T16:18:46Z

demo/csi/hostpath/redis.nomad

@@ -42,4 +42,4 @@ job "example" {
      }
    }
  }
-}
+}


Little bit of debris to cleanup here.

I cant remove it :s

You can remove it if you flatten the commits. Or you can update your editor config so that you make sure it's always adding the newline EOF (you want that for posix-compliance... run wc -l on this file and you'll see it's one line short!)

nomad/structs/volumes.go

shoenig · 2024-01-30T17:27:51Z

nomad/structs/volume_test.go

+			err := tc.volMount.Validate()
+			if !errors.Is(err, tc.expectedErr) {
+				t.Fatalf("expected error %v, got %v", tc.expectedErr, err)
+			}


can be shortened to something like must.ErrorIs(t, tc.expectedErr, err)

must.ErrorIs doesn't work here, probably something with the unwarpping of the errors

website/content/docs/job-specification/volume_mount.mdx

shoenig

LGTM!

lgfa29 · 2024-01-30T17:49:47Z

nomad/structs/structs.go

 			mErr.Errors = append(mErr.Errors, fmt.Errorf("Volume Mount (%d) references undefined volume %s", idx, vm.Volume))
+		} else if err := vm.Validate(); err != nil {
+			mErr.Errors = append(mErr.Errors, fmt.Errorf("Volume Mount (%d) is invalid: \"%w\"", idx, err))


Do you have an example of how this error looks like? I'm not sure why we do it in some many parts of the code, but appending directly to mErr.Errors usually results in a bad error hierarchy.

it is actually called in the task group validation test, it should not be a problem

lgfa29 · 2024-01-30T17:54:47Z

nomad/structs/volumes.go

+		mErr.Errors = append(mErr.Errors, errVolMountEmptyVol)
+	}
+
+	if !v.MountPropagationModeIsValid() {
+		mErr.Errors = append(mErr.Errors, fmt.Errorf("%w: %q", errVolMountInvalidPropagationMode, v.PropagationMode))
+	}
+
+	if !v.SELinuxLabelIsValid() {
+		mErr.Errors = append(mErr.Errors, fmt.Errorf("%w: \"%s\"", errVolMountInvalidSELinuxLabel, v.SELinuxLabel))


Suggested change

mErr.Errors = append(mErr.Errors, errVolMountEmptyVol)

}

if !v.MountPropagationModeIsValid() {

mErr.Errors = append(mErr.Errors, fmt.Errorf("%w: %q", errVolMountInvalidPropagationMode, v.PropagationMode))

}

if !v.SELinuxLabelIsValid() {

mErr.Errors = append(mErr.Errors, fmt.Errorf("%w: \"%s\"", errVolMountInvalidSELinuxLabel, v.SELinuxLabel))

mErr= multierror.Append(mErr, errVolMountEmptyVol)

}

if !v.MountPropagationModeIsValid() {

mErr = multierror.Append(mErr, fmt.Errorf("%w: %q", errVolMountInvalidPropagationMode, v.PropagationMode))

}

if !v.SELinuxLabelIsValid() {

mErr= multierror.Append(mErr, fmt.Errorf("%w: \"%s\"", errVolMountInvalidSELinuxLabel, v.SELinuxLabel))

Since this is new code, we may as well use the nicer method 😄

website/content/docs/job-specification/volume_mount.mdx

Co-authored-by: Tim Gross <tgross@hashicorp.com>

Co-authored-by: Luiz Aoqui <luiz@hashicorp.com>

…lume

Add new configuration option on task's volume_mounts, to give a fine grained control over SELinux "z" label * Update website/content/docs/job-specification/volume_mount.mdx Co-authored-by: Luiz Aoqui <luiz@hashicorp.com> * fix: typo * func: make volume mount verification happen even on mounts with no volume --------- Co-authored-by: Luiz Aoqui <luiz@hashicorp.com> Co-authored-by: Tim Gross <tgross@hashicorp.com>

Juanadelacuesta force-pushed the f-volume-mount-label branch from 0783286 to d79c4cd Compare January 29, 2024 12:27

vercel bot deployed to Preview – nomad-storybook-and-ui January 29, 2024 12:32 View deployment

vercel bot deployed to Preview – nomad-storybook-and-ui January 29, 2024 14:43 View deployment

vercel bot deployed to Preview – nomad-storybook-and-ui January 30, 2024 12:48 View deployment

Juanadelacuesta changed the title ~~tmp~~ Add granular control of SELinux labels for host mounts Jan 30, 2024

Juanadelacuesta force-pushed the f-volume-mount-label branch 2 times, most recently from a1facca to ea9a103 Compare January 30, 2024 14:09

vercel bot deployed to Preview – nomad-storybook-and-ui January 30, 2024 14:15 View deployment

Juanadelacuesta requested review from shoenig, lgfa29, gulducat and tgross January 30, 2024 14:23

Juanadelacuesta force-pushed the f-volume-mount-label branch from 34d4683 to 04c759f Compare January 30, 2024 14:32

vercel bot deployed to Preview – nomad-storybook-and-ui January 30, 2024 14:42 View deployment

Juanadelacuesta marked this pull request as ready for review January 30, 2024 16:02

tgross reviewed Jan 30, 2024

View reviewed changes

vercel bot deployed to Preview – nomad-storybook-and-ui January 30, 2024 17:07 View deployment

shoenig reviewed Jan 30, 2024

View reviewed changes

website/content/docs/job-specification/volume_mount.mdx Show resolved Hide resolved

shoenig approved these changes Jan 30, 2024

View reviewed changes

lgfa29 approved these changes Jan 30, 2024

View reviewed changes

vercel bot deployed to Preview – nomad-storybook-and-ui January 31, 2024 08:32 View deployment

lgfa29 and others added 7 commits January 31, 2024 10:04

tmp

94cab10

func: update protobuff to include selinux

24731b5

func: add validation for volume mount selinux label

89c867b

func: add tests for mount validation

6ac6be8

func: update test

2d86cca

fix: put back original csi host path demo

43bf61b

docs: add new option to volume_mount docs

f882746

Juanadelacuesta and others added 3 commits January 31, 2024 10:04

docs: add changelog entry for selinux labels

a765057

Update nomad/structs/volumes.go

bacccf6

Co-authored-by: Tim Gross <tgross@hashicorp.com>

Update nomad/structs/volumes.go

1cb6ef0

Co-authored-by: Tim Gross <tgross@hashicorp.com>

Juanadelacuesta force-pushed the f-volume-mount-label branch from 770b2dc to 1cb6ef0 Compare January 31, 2024 09:04

Juanadelacuesta and others added 2 commits January 31, 2024 10:06

style: add missing nl

d1c9a4d

Update website/content/docs/job-specification/volume_mount.mdx

2575729

Co-authored-by: Luiz Aoqui <luiz@hashicorp.com>

vercel bot deployed to Preview – nomad January 31, 2024 09:12 View deployment

vercel bot deployed to Preview – nomad-storybook-and-ui January 31, 2024 09:12 View deployment

fix: typo

4e6d4da

vercel bot deployed to Preview – nomad-storybook-and-ui January 31, 2024 09:23 View deployment

func: make volume mount verification happen even on mounts with no vo…

dfbfea1

…lume

vercel bot deployed to Preview – nomad-storybook-and-ui January 31, 2024 09:35 View deployment

Juanadelacuesta merged commit 120c3ca into main Feb 5, 2024
21 checks passed

Juanadelacuesta deleted the f-volume-mount-label branch February 5, 2024 09:05

Juanadelacuesta added the backport/1.7.x backport to 1.7.x release line label Apr 17, 2024

hc-github-team-nomad-core mentioned this pull request Apr 17, 2024

Backport of Add granular control of SELinux labels for host mounts into release/1.7.x #20423

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add granular control of SELinux labels for host mounts #19839

Add granular control of SELinux labels for host mounts #19839

Juanadelacuesta commented Jan 29, 2024 •

edited

Loading

hashicorp-cla commented Jan 29, 2024 •

edited

Loading

tgross left a comment •

edited

Loading

tgross Jan 30, 2024

Juanadelacuesta Jan 30, 2024

tgross Jan 30, 2024

shoenig Jan 30, 2024

Juanadelacuesta Jan 31, 2024

shoenig left a comment

lgfa29 Jan 30, 2024

Juanadelacuesta Jan 31, 2024

lgfa29 Jan 30, 2024

@@ @@ -42,4 +42,4 @@ job "example" { @@
                     }
                   }
                 }
-              }
+              }

Add granular control of SELinux labels for host mounts #19839

Add granular control of SELinux labels for host mounts #19839

Conversation

Juanadelacuesta commented Jan 29, 2024 • edited Loading

hashicorp-cla commented Jan 29, 2024 • edited Loading

tgross left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shoenig left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Juanadelacuesta commented Jan 29, 2024 •

edited

Loading

hashicorp-cla commented Jan 29, 2024 •

edited

Loading

tgross left a comment •

edited

Loading