-
Bug
-
Resolution: Done-Errata
-
Major
-
None
-
4.12.z
-
None
-
Quality / Stability / Reliability
-
False
-
-
2
-
Important
-
No
-
None
-
None
-
None
-
CMP Sprint 71
-
1
-
+
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
SelinuxProfiles do not inherit the custom SelinuxProfiles from the same namespace.
Version-Release number of selected component (if applicable):
OCP 4.12 + SPO 0.7.1
How reproducible:
>> Yes reproducible
Steps to Reproduce:
1.Create a selinuxProfile in any namespace as per the attachment cdmrf-common
2. Inherit the cdmrf-common SelinuxProfile to other SelinuxProfile cdmrf-hook in the same namespace
~~~
inherit:
- kind: SelinuxProfile
name: cdmrf-common
~~~
3. It will go into the Error state as follows:
~~~
"status": {
"conditions": [
{
"lastTransitionTime": "2023-08-01T16:00:27Z",
"reason": "Unavailable",
"status": "False",
"type": "Ready"
}
],
"status": "Error",
"usage": "cdmrf-hooks_openshift-security-profiles.process"
}
}
~~~
4. Also found the following error in the events:
~~~
Profile failed validation on ip-10-0-159-170.ap-south-1.compute.internal: SelinuxProfile/cdmrf-common: unknown inherit kind for entry
~~~
Actual results:
SelinuxProfile cdmrf-common is not inherited with cdmrf-hook SelinuxProfile created in the same namespace
Expected results:
During inheritance, there should not be any errors.
Additional info:
Found SelinuxPolicy kind in the code[1] which should be fixed. We have tested with SelinuxPolicy kind but not worked. ~~~ Error "Unsupported value: "SelinuxPolicy": supported values: "System", "SelinuxProfile"" for field "spec.inherit[0].kind". ~~~ It would be also fixed in the document[1] code[1]: https://github.com/openshift/security-profiles-operator/blob/main/internal/pkg/daemon/selinuxprofile/selinuxprofile.go#L133-L140 Here is the slack Thread discussion: https://redhat-internal.slack.com/archives/CHCRR73PF/p1690819591084249
- links to
-
RHBA-2023:5958
OpenShift Security Profiles Operator bug fix update