SELinux Overhaul #33663

pmorie · 2016-09-28T14:58:05Z

Overhauls handling of SELinux in Kubernetes. TLDR: Kubelet dir no longer has to be labeled svirt_sandbox_file_t.

Fixes #33351 and #33510. Implements #33951.

This change is

yifan-gu · 2016-09-28T19:04:06Z

cc @kubernetes/sig-node @kubernetes/sig-rktnetes

pmorie · 2016-10-24T22:52:51Z

@yifan-gu ready for review, PTAL.

pmorie · 2016-10-24T22:54:21Z

hack/local-up-cluster.sh

@@ -510,7 +498,7 @@ function start_kubelet {
        --volume=/var/run:/var/run:rw \
        --volume=/sys:/sys:ro \
        --volume=/var/lib/docker/:/var/lib/docker:ro \
-        --volume=/var/lib/kubelet/:/var/lib/kubelet:rw,z \
+        --volume=/var/lib/kubelet/:/var/lib/kubelet:rw \


Note, the relabel to a shared SELinux context should no longer be necessary, because the Kubelet will be running with spc_t due to running in a privileged container, which is unconfined.

k8s-ci-robot · 2016-10-26T16:18:47Z

Jenkins GCE etcd3 e2e failed for commit aa855b9. Full PR test history.

The magic incantation to run this job again is @k8s-bot gce etcd3 e2e test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

k8s-ci-robot · 2016-10-26T16:20:17Z

Jenkins GCE e2e failed for commit aa855b9. Full PR test history.

The magic incantation to run this job again is @k8s-bot cvm gce e2e test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

k8s-ci-robot · 2016-10-26T16:20:47Z

Jenkins GCI GCE e2e failed for commit aa855b9. Full PR test history.

The magic incantation to run this job again is @k8s-bot gci gce e2e test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

feiskyer · 2016-10-27T00:50:07Z

@k8s-bot test this please, issue #IGNORE.

feiskyer · 2016-10-27T01:40:00Z

lgtm

feiskyer · 2016-10-27T01:40:54Z

@euank @squeed would you like to take another look?

pmorie · 2016-10-27T01:42:14Z

cc @aveshagarwal @ingvagabund

ingvagabund · 2016-10-27T11:30:20Z

pkg/kubelet/dockertools/docker_manager.go

+
+			// Have docker relabel the termination log path if SELinux is
+			// enabled.
+			if selinux.SELinuxEnabled() {


Any reason why this was not here before?

I wasn't as smart before :) It was a bug.

ingvagabund · 2016-10-27T11:45:07Z

pkg/kubelet/kubelet_pods.go

+		ContainerPath:  etcHostsPath,
+		HostPath:       hostsFilePath,
+		ReadOnly:       false,
+		SELinuxRelabel: true,


Maybe comment it with Isolate pods on each host from one another by default? Thought it is already captured in the docs (I liked reading it), the comment here could help to make the correct associations sooner. Just nit.

@ingvagabund I'm not sure I understand what is being asked for here. Elaborate?

to point out the SELinuxRelabel is set to true to isolate the pods from each other by default.

feiskyer · 2016-11-01T00:40:34Z

ping @yifan-gu @pmorie. Any updates to this?

yifan-gu · 2016-11-01T01:08:13Z

LGTM
@ingvagabund I reassigned to you, feel free to apply lgtm label :)

k8s-github-robot · 2016-11-01T11:26:02Z

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

k8s-github-robot · 2016-11-01T12:04:17Z

Automatic merge from submit-queue

Automatic merge from submit-queue Remove GetRootContext method from VolumeHost interface Remove the `GetRootContext` call from the `VolumeHost` interface, since Kubernetes no longer needs to know the SELinux context of the Kubelet directory. Per #33951 and #35127. Depends on #33663; only the last commit is relevant to this PR.

The original change that added the unconfined label included a comment indicating it won't be needed in the future. See: kubernetes#33555 (comment) That time is now. kubernetes#33663 has landed and means we no longer have to go out of our way to make that work. Removing the label also increases security since there wasn't really a good reason for etcd to be run with such broad selinux privileges. This also will allow kubeadm to avoid errors on distros without an spc_t type, such as Gentoo and Container Linux (at the time of writing at least). Fixes kubernetes/kubeadm#269

Automatic merge from submit-queue (batch tested with PRs 49328, 49285, 49307, 49127, 49163) kubeadm: don't customize etcd selinux label The original change that added the unconfined label included a comment indicating it won't be needed in the future. See: #33555 (comment) That time is now. #33663 has landed and means we no longer have to go out of our way to make that work. Removing the label also increases security since there wasn't really a good reason for etcd to be run with such broad selinux privileges. This also will allow kubeadm to avoid errors on distros without an spc_t type, such as Gentoo and Container Linux (at the time of writing at least). Fixes kubernetes/kubeadm#269 **Release note**: ```release-note NONE ```

The original change that added the unconfined label included a comment indicating it won't be needed in the future. See: kubernetes#33555 (comment) That time is now. kubernetes#33663 has landed and means we no longer have to go out of our way to make that work. Removing the label also increases security since there wasn't really a good reason for etcd to be run with such broad selinux privileges. This also will allow kubeadm to avoid errors on distros without an spc_t type, such as Gentoo and Container Linux (at the time of writing at least). Fixes kubernetes/kubeadm#269

Automatic merge from submit-queue Remove GetRootContext method from VolumeHost interface Remove the `GetRootContext` call from the `VolumeHost` interface, since Kubernetes no longer needs to know the SELinux context of the Kubelet directory. Per kubernetes#33951 and kubernetes#35127. Depends on kubernetes#33663; only the last commit is relevant to this PR.

googlebot added the cla: yes label Sep 28, 2016

k8s-github-robot assigned ixdy Sep 28, 2016

k8s-github-robot added kind/design Categorizes issue or PR as related to design. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. release-note-label-needed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Sep 28, 2016

pmorie assigned yifan-gu and unassigned ixdy Sep 28, 2016

pmorie added do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Sep 28, 2016

k8s-github-robot removed the release-note-label-needed label Sep 28, 2016

pmorie force-pushed the selinux-fixes branch from a3f3bf6 to 18dfe60 Compare September 28, 2016 16:46

k8s-github-robot removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. kind/design Categorizes issue or PR as related to design. labels Sep 28, 2016

k8s-github-robot mentioned this pull request Sep 28, 2016

[k8s.io] Kubectl client [k8s.io] Guestbook application should create and stop a working application [Conformance] {Kubernetes e2e suite} #33672

Closed

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 5, 2016

pmorie force-pushed the selinux-fixes branch from 18dfe60 to 6fda53c Compare October 19, 2016 14:03

k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 19, 2016

pmorie force-pushed the selinux-fixes branch from 6fda53c to 72d9d14 Compare October 20, 2016 20:52

pmorie mentioned this pull request Oct 21, 2016

CRI: Add security context for sandbox/container #34811

Merged

pmorie force-pushed the selinux-fixes branch 3 times, most recently from 591246b to 698fca6 Compare October 24, 2016 22:51

pmorie changed the title ~~WIP: SELinux Overhaul~~ SELinux Overhaul Oct 24, 2016

pmorie commented Oct 24, 2016

View reviewed changes

pmorie added area/kubelet area/security and removed do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. labels Oct 24, 2016

pmorie added 3 commits October 26, 2016 10:39

Always relabel supported volumes when SELinux is enabled

21116a7

Remove use of RootContext in empty_dir.go

69d7297

Update bazel configurations

aa855b9

pmorie force-pushed the selinux-fixes branch from e2387de to aa855b9 Compare October 26, 2016 15:11

ingvagabund reviewed Oct 27, 2016

View reviewed changes

pmorie added this to the v1.5 milestone Oct 28, 2016

yifan-gu assigned ingvagabund and unassigned yifan-gu Nov 1, 2016

ingvagabund added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 1, 2016

k8s-github-robot merged commit 44b684a into kubernetes:master Nov 1, 2016

chentao1596 mentioned this pull request Dec 5, 2016

WIP:kubelet: support multi-headers when getting pod from HTTP source #38089

Closed

euank mentioned this pull request Jul 20, 2017

etcd pause container fails to start due to SELinux error on CoreOS kubernetes/kubeadm#269

Closed

euank mentioned this pull request Jul 20, 2017

kubeadm: don't customize etcd selinux label #49328

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SELinux Overhaul #33663

SELinux Overhaul #33663

pmorie commented Sep 28, 2016 •

edited

Loading

yifan-gu commented Sep 28, 2016

pmorie commented Oct 24, 2016

pmorie Oct 24, 2016

k8s-ci-robot commented Oct 26, 2016

k8s-ci-robot commented Oct 26, 2016

k8s-ci-robot commented Oct 26, 2016

feiskyer commented Oct 27, 2016

feiskyer commented Oct 27, 2016

feiskyer commented Oct 27, 2016

pmorie commented Oct 27, 2016

ingvagabund Oct 27, 2016

pmorie Oct 28, 2016

ingvagabund Oct 27, 2016

pmorie Oct 28, 2016

ingvagabund Oct 31, 2016

feiskyer commented Nov 1, 2016

yifan-gu commented Nov 1, 2016

k8s-github-robot commented Nov 1, 2016

k8s-github-robot commented Nov 1, 2016

SELinux Overhaul #33663

SELinux Overhaul #33663

Conversation

pmorie commented Sep 28, 2016 • edited Loading

yifan-gu commented Sep 28, 2016

pmorie commented Oct 24, 2016

pmorie Oct 24, 2016

Choose a reason for hiding this comment

k8s-ci-robot commented Oct 26, 2016

k8s-ci-robot commented Oct 26, 2016

k8s-ci-robot commented Oct 26, 2016

feiskyer commented Oct 27, 2016

feiskyer commented Oct 27, 2016

feiskyer commented Oct 27, 2016

pmorie commented Oct 27, 2016

ingvagabund Oct 27, 2016

Choose a reason for hiding this comment

pmorie Oct 28, 2016

Choose a reason for hiding this comment

ingvagabund Oct 27, 2016

Choose a reason for hiding this comment

pmorie Oct 28, 2016

Choose a reason for hiding this comment

ingvagabund Oct 31, 2016

Choose a reason for hiding this comment

feiskyer commented Nov 1, 2016

yifan-gu commented Nov 1, 2016

k8s-github-robot commented Nov 1, 2016

k8s-github-robot commented Nov 1, 2016

pmorie commented Sep 28, 2016 •

edited

Loading