Skip to content

Commit

Permalink
Add /etc/cni to the rke2-selinux context (#67)
Browse files Browse the repository at this point in the history 
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
  • Loading branch information
@galal-hussein
galal-hussein committed Apr 25, 2024
1 parent 33885cf commit ccc4d04
Show file tree
Hide file tree
Showing 10 changed files with 15 additions and 0 deletions.
2 changes: 2 additions & 0 deletions policy/centos7/rke2-selinux.spec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
%define rke2_relabel_files() \
mkdir -p /var/lib/cni; \
mkdir -p /opt/cni; \
mkdir -p /etc/cni; \
mkdir -p /var/lib/kubelet/pods; \
mkdir -p /var/lib/rancher/rke2/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots; \
mkdir -p /var/lib/rancher/rke2/data; \
Expand All @@ -12,6 +13,7 @@ restorecon -R -i /etc/systemd/system/rke2*; \
restorecon -R -i /usr/lib/systemd/system/rke2*; \
restorecon -R /var/lib/cni; \
restorecon -R /opt/cni; \
restorecon -R /etc/cni; \
restorecon -R /var/lib/kubelet; \
restorecon -R /var/lib/rancher; \
restorecon -R /var/run/k3s; \
Expand Down
1 change: 1 addition & 0 deletions policy/centos7/rke2.fc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
/usr/local/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0)
/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0)
Expand Down
2 changes: 2 additions & 0 deletions policy/centos8/rke2-selinux.spec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
%define rke2_relabel_files() \
mkdir -p /var/lib/cni; \
mkdir -p /opt/cni; \
mkdir -p /etc/cni; \
mkdir -p /var/lib/kubelet/pods; \
mkdir -p /var/lib/rancher/rke2/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots; \
mkdir -p /var/lib/rancher/rke2/data; \
Expand All @@ -12,6 +13,7 @@ restorecon -R -i /etc/systemd/system/rke2*; \
restorecon -R -i /usr/lib/systemd/system/rke2*; \
restorecon -R /var/lib/cni; \
restorecon -R /opt/cni; \
restorecon -R /etc/cni; \
restorecon -R /var/lib/kubelet; \
restorecon -R /var/lib/rancher; \
restorecon -R /var/run/k3s; \
Expand Down
1 change: 1 addition & 0 deletions policy/centos8/rke2.fc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
/usr/local/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0)
#/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
#/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0)
Expand Down
2 changes: 2 additions & 0 deletions policy/centos9/rke2-selinux.spec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
%define rke2_relabel_files() \
mkdir -p /var/lib/cni; \
mkdir -p /opt/cni; \
mkdir -p /etc/cni; \
mkdir -p /var/lib/kubelet/pods; \
mkdir -p /var/lib/rancher/rke2/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots; \
mkdir -p /var/lib/rancher/rke2/data; \
Expand All @@ -13,6 +14,7 @@ restorecon -R -i /usr/local/lib/systemd/system/rke2*; \
restorecon -R -i /usr/lib/systemd/system/rke2*; \
restorecon -R /var/lib/cni; \
restorecon -R /opt/cni; \
restorecon -R /etc/cni; \
restorecon -R /var/lib/kubelet; \
restorecon -R /var/lib/rancher; \
restorecon -R /var/run/k3s; \
Expand Down
1 change: 1 addition & 0 deletions policy/centos9/rke2.fc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
/usr/local/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0)
#/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
#/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0)
Expand Down
2 changes: 2 additions & 0 deletions policy/microos/rke2-selinux.spec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
%define rke2_relabel_files() \
mkdir -p /var/lib/cni; \
mkdir -p /opt/cni; \
mkdir -p /etc/cni; \
mkdir -p /var/lib/kubelet/pods; \
mkdir -p /var/lib/rancher/rke2/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots; \
mkdir -p /var/lib/rancher/rke2/data; \
Expand All @@ -12,6 +13,7 @@ restorecon -R -i /etc/systemd/system/rke2*; \
restorecon -R -i /usr/lib/systemd/system/rke2*; \
restorecon -R /var/lib/cni; \
restorecon -R /opt/cni; \
restorecon -R /etc/cni; \
restorecon -R /var/lib/kubelet; \
restorecon -R /var/lib/rancher; \
restorecon -R /var/run/k3s; \
Expand Down
1 change: 1 addition & 0 deletions policy/microos/rke2.fc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
/usr/local/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0)
#/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
#/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0)
Expand Down
2 changes: 2 additions & 0 deletions policy/slemicro/rke2-selinux.spec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
%define rke2_relabel_files() \
mkdir -p /var/lib/cni; \
mkdir -p /opt/cni; \
mkdir -p /etc/cni; \
mkdir -p /var/lib/kubelet/pods; \
mkdir -p /var/lib/rancher/rke2/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots; \
mkdir -p /var/lib/rancher/rke2/data; \
Expand All @@ -12,6 +13,7 @@ restorecon -R -i /etc/systemd/system/rke2*; \
restorecon -R -i /usr/lib/systemd/system/rke2*; \
restorecon -R /var/lib/cni; \
restorecon -R /opt/cni; \
restorecon -R /etc/cni; \
restorecon -R /var/lib/kubelet; \
restorecon -R /var/lib/rancher; \
restorecon -R /var/run/k3s; \
Expand Down
1 change: 1 addition & 0 deletions policy/slemicro/rke2.fc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
/opt/rke2/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0)
#/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0)
#/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0)
/var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0)
Expand Down

0 comments on commit ccc4d04

Please sign in to comment.