-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
4.18.0
-
None
-
None
-
Proposed
-
False
-
-
Release Note Not Required
-
In Progress
Description of problem:
Before the kubelet systemd service runs kubelet binary it calls the restorecon command: https://github.com/openshift/machine-config-operator/blob/master/templates/worker/01-worker-kubelet/on-prem/units/kubelet.service.yaml#L13 But the restorecon command expects a path to be given. providing a path is mandatory. see man page: https://linux.die.net/man/8/restorecon At the moment the command does nothing and the error is swallowed due to the dash (-) in the beginning of the command. This results with files that are labeled with wrong SELinux labels. for example: After https://github.com/containers/container-selinux/pull/329 got merged /var/lib/kubelet/pod-resources/* expected to be running with kubelet_var_lib_t label but it's not. it's running with the old label - container_var_lib_t
Version-Release number of selected component (if applicable):
4.18
How reproducible:
Always
Steps to Reproduce:
1. Check the SELinux labels of files under the system with ls -Z command.
Actual results:
files are labeled with a wrong SELinux labels
Expected results:
file's SELinux labels are suppose the match their configuration as it captured in the container-selinux package.
Additional info:
- links to
-
RHEA-2024:6122 OpenShift Container Platform 4.18.z bug fix update