Uploaded image for project: 'Cloud Infrastructure Security & Compliance'
  1. Cloud Infrastructure Security & Compliance
  2. CMP-3664

The profilerecording process fails to create the expected SELinux profile

XMLWordPrintable

    • Important

      Description of problem:

       

      When trying to do Log enricher based selinuxprofiles recording for deployment,selinuxprofile will not be created after deployment deleted. 
      The weird point is: after the workload created, in log-enricher container of the spod pods, the profile type to be recorded is seccomp, not selinux.
       % oc get pod
      NAME                              READY   STATUS    RESTARTS   AGE
      hello-openshift-6d576cf98-9g66m   2/2     Running   0          11s
      hello-openshift-6d576cf98-b2c2m   2/2     Running   0          11s
      hello-openshift-6d576cf98-jmcl4   2/2     Running   0          11s
      % oc get deploy
      NAME              READY   UP-TO-DATE   AVAILABLE   AGE
      hello-openshift   3/3     3            3           15s   Description of problem:
       
      When trying to do Log enricher based selinuxprofiles recording for deployment,selinuxprofile will not be created after deployment deleted. 
      The weird point is: after the workload created, there is no scontext or tcontext info the spod logs in log-enricher container; Instead, the type is seccomp.
      % oc get pod
      NAME                              READY   STATUS    RESTARTS   AGE
      hello-openshift-6d576cf98-9g66m   2/2     Running   0          11s
      hello-openshift-6d576cf98-b2c2m   2/2     Running   0          11s
      hello-openshift-6d576cf98-jmcl4   2/2     Running   0          11s
      % oc get deploy
      NAME              READY   UP-TO-DATE   AVAILABLE   AGE
      hello-openshift   3/3     3            3           15s   
      In log-enricher container:
      audit logger=log-enricher type=seccomp node=NODE_NAME namespace=mytest pod=hello-openshift-6d576cf98-9g66m container=redis  pid=110067 syscallID=39 syscallName=getpid
      ...           
              

      Version-Release number of selected component (if applicable):

          

      How reproducible:

          

      Steps to Reproduce:

      1. Install SPO security-profiles-operator.v0.9.0 
      2. Setting enableLogEnricher to true
      $ oc -n openshift-security-profiles patch spod spod --type=merge -p '{"spec":{"enableLogEnricher":true}}'
      
      3. Create a ns and set the right labels
       oc new-project mytest
      $ oc label ns mytest spo.x-k8s.io/enable-recording="true"
      $ oc label ns mytest security.openshift.io/scc.podSecurityLabelSync=false pod-security.kubernetes.io/enforce=privileged  --overwrite=true
      
      4. Create a profilerecording
      % oc apply -f -<<EOF
      apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
      kind: ProfileRecording
      metadata:
        name: hello-openshift-recording
      spec:
        kind: SelinuxProfile
        recorder: logs
        podSelector:
          matchLabels:
            app: hello-openshift
      EOF
      profilerecording.security-profiles-operator.x-k8s.io/hello-openshift-recording created
      
      5. Create a deployment to be recorded
      
      6. Delete the deployment 
          

      Actual results:

      At step5, after the workload created, in log-enricher container of the spod pods, the profile type to be recorded is seccomp, not selinux.
      At step 6, no selinuxprofile created.

      Expected results:

      Selinuxprofile should be created.    

      Additional info:

        

              xiyuan@redhat.com Xiaojie Yuan
              xiyuan@redhat.com Xiaojie Yuan
              Xiaojie Yuan Xiaojie Yuan
              Maria Simon Marcos Maria Simon Marcos
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: