Skip to content

Commit 51a6b50

Browse files
supersebsuperseb
authored
Revert "Do not rewrite SELinux labels on volume mounts"
1 parent e0b8922 commit 51a6b50

File tree

9 files changed

+42
-91
lines changed

9 files changed

+42
-91
lines changed

‎cluster/cluster.go

-1
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,6 @@ const (
9999
NameLabel = "name"
100100

101101
WorkerThreads = util.WorkerThreads
102-
SELinuxLabel = services.SELinuxLabel
103102

104103
serviceAccountTokenFileParam = "service-account-key-file"
105104

‎cluster/file-deployer.go

+1-7
Original file line numberDiff line numberDiff line change
@@ -60,15 +60,9 @@ func doDeployFile(ctx context.Context, host *hosts.Host, fileName, fileContents,
6060
}
6161
hostCfg := &container.HostConfig{
6262
Binds: []string{
63-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
63+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
6464
},
6565
}
66-
if hosts.IsDockerSELinuxEnabled(host) {
67-
// We apply the label because we do not rewrite SELinux labels anymore on volume mounts (no :z)
68-
logrus.Debugf("Applying security opt label [%s] for [%s] container on host [%s]", SELinuxLabel, ContainerName, host.Address)
69-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
70-
}
71-
7266
if err := docker.DoRunOnetimeContainer(ctx, host.DClient, imageCfg, hostCfg, ContainerName, host.Address, ServiceName, prsMap); err != nil {
7367
return err
7468
}

‎cluster/plan.go

+18-18
Original file line numberDiff line numberDiff line change
@@ -266,10 +266,10 @@ func (c *Cluster) BuildKubeAPIProcess(host *hosts.Host, serviceOptions v3.Kubern
266266
services.SidekickContainerName,
267267
}
268268
Binds := []string{
269-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
269+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
270270
}
271271
if c.Services.KubeAPI.AuditLog != nil && c.Services.KubeAPI.AuditLog.Enabled {
272-
Binds = append(Binds, fmt.Sprintf("%s:/var/log/kube-audit", path.Join(host.PrefixPath, "/var/log/kube-audit")))
272+
Binds = append(Binds, fmt.Sprintf("%s:/var/log/kube-audit:z", path.Join(host.PrefixPath, "/var/log/kube-audit")))
273273
bytes, err := yaml.Marshal(c.Services.KubeAPI.AuditLog.Configuration.Policy)
274274
if err != nil {
275275
logrus.Warnf("Error while marshalling auditlog policy: %v", err)
@@ -358,7 +358,7 @@ func (c *Cluster) BuildKubeControllerProcess(host *hosts.Host, serviceOptions v3
358358
services.SidekickContainerName,
359359
}
360360
Binds := []string{
361-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
361+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
362362
}
363363

364364
for arg, value := range c.Services.KubeController.ExtraArgs {
@@ -485,29 +485,29 @@ func (c *Cluster) BuildKubeletProcess(host *hosts.Host, serviceOptions v3.Kubern
485485
}
486486
} else {
487487
Binds = []string{
488-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
489-
"/etc/cni:/etc/cni:rw",
490-
"/opt/cni:/opt/cni:rw",
491-
fmt.Sprintf("%s:/var/lib/cni", path.Join(host.PrefixPath, "/var/lib/cni")),
492-
"/var/lib/calico:/var/lib/calico",
488+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
489+
"/etc/cni:/etc/cni:rw,z",
490+
"/opt/cni:/opt/cni:rw,z",
491+
fmt.Sprintf("%s:/var/lib/cni:z", path.Join(host.PrefixPath, "/var/lib/cni")),
492+
"/var/lib/calico:/var/lib/calico:z",
493493
"/etc/resolv.conf:/etc/resolv.conf",
494494
"/sys:/sys:rprivate",
495-
host.DockerInfo.DockerRootDir + ":" + host.DockerInfo.DockerRootDir + ":rw,rslave",
496-
fmt.Sprintf("%s:%s:shared", path.Join(host.PrefixPath, "/var/lib/kubelet"), path.Join(host.PrefixPath, "/var/lib/kubelet")),
497-
"/var/lib/rancher:/var/lib/rancher:shared",
495+
host.DockerInfo.DockerRootDir + ":" + host.DockerInfo.DockerRootDir + ":rw,rslave,z",
496+
fmt.Sprintf("%s:%s:shared,z", path.Join(host.PrefixPath, "/var/lib/kubelet"), path.Join(host.PrefixPath, "/var/lib/kubelet")),
497+
"/var/lib/rancher:/var/lib/rancher:shared,z",
498498
"/var/run:/var/run:rw,rprivate",
499499
"/run:/run:rprivate",
500500
fmt.Sprintf("%s:/etc/ceph", path.Join(host.PrefixPath, "/etc/ceph")),
501501
"/dev:/host/dev:rprivate",
502-
"/var/log/containers:/var/log/containers",
503-
"/var/log/pods:/var/log/pods",
502+
"/var/log/containers:/var/log/containers:z",
503+
"/var/log/pods:/var/log/pods:z",
504504
"/usr:/host/usr:ro",
505505
"/etc:/host/etc:ro",
506506
}
507507

508508
// Special case to simplify using flex volumes
509509
if path.Join(host.PrefixPath, "/var/lib/kubelet") != "/var/lib/kubelet" {
510-
Binds = append(Binds, "/var/lib/kubelet/volumeplugins:/var/lib/kubelet/volumeplugins:shared")
510+
Binds = append(Binds, "/var/lib/kubelet/volumeplugins:/var/lib/kubelet/volumeplugins:shared,z")
511511
}
512512
}
513513
Binds = append(Binds, host.GetExtraBinds(kubelet.BaseService)...)
@@ -622,7 +622,7 @@ func (c *Cluster) BuildKubeProxyProcess(host *hosts.Host, serviceOptions v3.Kube
622622
}
623623
} else {
624624
Binds = []string{
625-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
625+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
626626
"/run:/run",
627627
}
628628

@@ -740,7 +740,7 @@ func (c *Cluster) BuildSchedulerProcess(host *hosts.Host, serviceOptions v3.Kube
740740
services.SidekickContainerName,
741741
}
742742
Binds := []string{
743-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
743+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
744744
}
745745

746746
for arg, value := range c.Services.Scheduler.ExtraArgs {
@@ -910,8 +910,8 @@ func (c *Cluster) BuildEtcdProcess(host *hosts.Host, etcdHosts []*hosts.Host, se
910910
}
911911

912912
Binds := []string{
913-
fmt.Sprintf("%s:%s", path.Join(host.PrefixPath, "/var/lib/etcd"), services.EtcdDataDir),
914-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
913+
fmt.Sprintf("%s:%s:z", path.Join(host.PrefixPath, "/var/lib/etcd"), services.EtcdDataDir),
914+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
915915
}
916916

917917
if serviceOptions.Etcd != nil {

‎hosts/hosts.go

+1-5
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@ const (
5151
CleanerContainerName = "kube-cleaner"
5252
LogCleanerContainerName = "rke-log-cleaner"
5353
RKELogsPath = "/var/lib/rancher/rke/log"
54-
SELinuxLabel = "label=type:rke_container_t"
5554

5655
B2DOS = "Boot2Docker"
5756
B2DPrefixPath = "/mnt/sda1/rke"
@@ -307,14 +306,11 @@ func buildCleanerConfig(host *Host, toCleanDirs []string, cleanerImage string) (
307306
}
308307
bindMounts := []string{}
309308
for _, vol := range toCleanDirs {
310-
bindMounts = append(bindMounts, fmt.Sprintf("%s:%s", vol, vol))
309+
bindMounts = append(bindMounts, fmt.Sprintf("%s:%s:z", vol, vol))
311310
}
312311
hostCfg := &container.HostConfig{
313312
Binds: bindMounts,
314313
}
315-
if IsDockerSELinuxEnabled(host) {
316-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
317-
}
318314
return imageCfg, hostCfg
319315
}
320316

‎pki/deploy.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ func DeployStateOnPlaneHost(ctx context.Context, host *hosts.Host, stateDownload
8686
}
8787
hostCfg := &container.HostConfig{
8888
Binds: []string{
89-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
89+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
9090
},
9191
Privileged: true,
9292
}
@@ -142,7 +142,7 @@ func doRunDeployer(ctx context.Context, host *hosts.Host, containerEnv []string,
142142
}
143143
hostCfg := &container.HostConfig{
144144
Binds: []string{
145-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
145+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
146146
},
147147
Privileged: true,
148148
}
@@ -300,7 +300,7 @@ func FetchFileFromHost(ctx context.Context, filePath, image string, host *hosts.
300300
}
301301
hostCfg := &container.HostConfig{
302302
Binds: []string{
303-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
303+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
304304
},
305305
Privileged: true,
306306
}

‎pki/pki.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,8 @@ func SaveBackupBundleOnHost(ctx context.Context, host *hosts.Host, alpineSystemI
112112
hostCfg := &container.HostConfig{
113113

114114
Binds: []string{
115-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
116-
fmt.Sprintf("%s:/backup", etcdSnapshotPath),
115+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
116+
fmt.Sprintf("%s:/backup:z", etcdSnapshotPath),
117117
},
118118
Privileged: true,
119119
}
@@ -149,8 +149,8 @@ func ExtractBackupBundleOnHost(ctx context.Context, host *hosts.Host, alpineSyst
149149
hostCfg := &container.HostConfig{
150150

151151
Binds: []string{
152-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(host.PrefixPath, "/etc/kubernetes")),
153-
fmt.Sprintf("%s:/backup", etcdSnapshotPath),
152+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(host.PrefixPath, "/etc/kubernetes")),
153+
fmt.Sprintf("%s:/backup:z", etcdSnapshotPath),
154154
},
155155
Privileged: true,
156156
}

‎services/controlplane.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -374,7 +374,7 @@ func RunGetStateFileFromConfigMap(ctx context.Context, controlPlaneHost *hosts.H
374374
}
375375
hostCfg := &container.HostConfig{
376376
Binds: []string{
377-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(controlPlaneHost.PrefixPath, "/etc/kubernetes")),
377+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(controlPlaneHost.PrefixPath, "/etc/kubernetes")),
378378
},
379379
NetworkMode: container.NetworkMode("host"),
380380
RestartPolicy: container.RestartPolicy{Name: "no"},

‎services/etcd.go

+14-47
Original file line numberDiff line numberDiff line change
@@ -346,16 +346,12 @@ func RunEtcdSnapshotSave(ctx context.Context, etcdHost *hosts.Host, prsMap map[s
346346
}
347347
hostCfg := &container.HostConfig{
348348
Binds: []string{
349-
fmt.Sprintf("%s:/backup", EtcdSnapshotPath),
350-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
349+
fmt.Sprintf("%s:/backup:z", EtcdSnapshotPath),
350+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
351351
NetworkMode: container.NetworkMode("host"),
352352
RestartPolicy: container.RestartPolicy{Name: restartPolicy},
353353
}
354354

355-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
356-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
357-
}
358-
359355
if once {
360356
log.Infof(ctx, "[etcd] Running snapshot save once on host [%s]", etcdHost.Address)
361357
logrus.Debugf("[etcd] Using command [%s] for snapshot save once container [%s] on host [%s]", getSanitizedSnapshotCmd(imageCfg, es.BackupConfig), EtcdSnapshotOnceContainerName, etcdHost.Address)
@@ -417,16 +413,12 @@ func RunGetStateFileFromSnapshot(ctx context.Context, etcdHost *hosts.Host, prsM
417413
}
418414
hostCfg := &container.HostConfig{
419415
Binds: []string{
420-
fmt.Sprintf("%s:/backup", EtcdSnapshotPath),
416+
fmt.Sprintf("%s:/backup:z", EtcdSnapshotPath),
421417
},
422418
NetworkMode: container.NetworkMode("host"),
423419
RestartPolicy: container.RestartPolicy{Name: "no"},
424420
}
425421

426-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
427-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
428-
}
429-
430422
if err := docker.DoRemoveContainer(ctx, etcdHost.DClient, EtcdStateFileContainerName, etcdHost.Address); err != nil {
431423
return "", err
432424
}
@@ -488,14 +480,11 @@ func DownloadEtcdSnapshotFromS3(ctx context.Context, etcdHost *hosts.Host, prsMa
488480
log.Infof(ctx, s3Logline)
489481
hostCfg := &container.HostConfig{
490482
Binds: []string{
491-
fmt.Sprintf("%s:/backup", EtcdSnapshotPath),
492-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
483+
fmt.Sprintf("%s:/backup:z", EtcdSnapshotPath),
484+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
493485
NetworkMode: container.NetworkMode("host"),
494486
RestartPolicy: container.RestartPolicy{Name: "no"},
495487
}
496-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
497-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
498-
}
499488
if err := docker.DoRemoveContainer(ctx, etcdHost.DClient, EtcdDownloadBackupContainerName, etcdHost.Address); err != nil {
500489
return err
501490
}
@@ -547,14 +536,11 @@ func RestoreEtcdSnapshot(ctx context.Context, etcdHost *hosts.Host, prsMap map[s
547536
}
548537
hostCfg := &container.HostConfig{
549538
Binds: []string{
550-
"/opt/rke/:/opt/rke/",
551-
fmt.Sprintf("%s:/var/lib/rancher/etcd", path.Join(etcdHost.PrefixPath, "/var/lib/etcd")),
552-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
539+
"/opt/rke/:/opt/rke/:z",
540+
fmt.Sprintf("%s:/var/lib/rancher/etcd:z", path.Join(etcdHost.PrefixPath, "/var/lib/etcd")),
541+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
553542
NetworkMode: container.NetworkMode("host"),
554543
}
555-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
556-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
557-
}
558544
if err := docker.DoRemoveContainer(ctx, etcdHost.DClient, EtcdRestoreContainerName, etcdHost.Address); err != nil {
559545
return err
560546
}
@@ -624,13 +610,10 @@ func RunEtcdSnapshotRemove(ctx context.Context, etcdHost *hosts.Host, prsMap map
624610

625611
hostCfg := &container.HostConfig{
626612
Binds: []string{
627-
fmt.Sprintf("%s:/backup", EtcdSnapshotPath),
613+
fmt.Sprintf("%s:/backup:z", EtcdSnapshotPath),
628614
},
629615
RestartPolicy: container.RestartPolicy{Name: "no"},
630616
}
631-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
632-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
633-
}
634617
if err := docker.DoRemoveContainer(ctx, etcdHost.DClient, EtcdSnapshotRemoveContainerName, etcdHost.Address); err != nil {
635618
return err
636619
}
@@ -667,12 +650,9 @@ func GetEtcdSnapshotChecksum(ctx context.Context, etcdHost *hosts.Host, prsMap m
667650
}
668651
hostCfg := &container.HostConfig{
669652
Binds: []string{
670-
"/opt/rke/:/opt/rke/",
653+
"/opt/rke/:/opt/rke/:z",
671654
}}
672655

673-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
674-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
675-
}
676656
if err := docker.DoRunContainer(ctx, etcdHost.DClient, imageCfg, hostCfg, EtcdChecksumContainerName, etcdHost.Address, ETCDRole, prsMap); err != nil {
677657
return checksum, err
678658
}
@@ -751,14 +731,11 @@ func StartBackupServer(ctx context.Context, etcdHost *hosts.Host, prsMap map[str
751731

752732
hostCfg := &container.HostConfig{
753733
Binds: []string{
754-
fmt.Sprintf("%s:/backup", EtcdSnapshotPath),
755-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
734+
fmt.Sprintf("%s:/backup:z", EtcdSnapshotPath),
735+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
756736
NetworkMode: container.NetworkMode("host"),
757737
RestartPolicy: container.RestartPolicy{Name: "no"},
758738
}
759-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
760-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
761-
}
762739
if err := docker.DoRemoveContainer(ctx, etcdHost.DClient, EtcdServeBackupContainerName, etcdHost.Address); err != nil {
763740
return err
764741
}
@@ -802,14 +779,11 @@ func DownloadEtcdSnapshotFromBackupServer(ctx context.Context, etcdHost *hosts.H
802779

803780
hostCfg := &container.HostConfig{
804781
Binds: []string{
805-
fmt.Sprintf("%s:/backup", EtcdSnapshotPath),
806-
fmt.Sprintf("%s:/etc/kubernetes", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
782+
fmt.Sprintf("%s:/backup:z", EtcdSnapshotPath),
783+
fmt.Sprintf("%s:/etc/kubernetes:z", path.Join(etcdHost.PrefixPath, "/etc/kubernetes"))},
807784
NetworkMode: container.NetworkMode("host"),
808785
RestartPolicy: container.RestartPolicy{Name: "on-failure"},
809786
}
810-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
811-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
812-
}
813787
if err := docker.DoRemoveContainer(ctx, etcdHost.DClient, EtcdDownloadBackupContainerName, etcdHost.Address); err != nil {
814788
return err
815789
}
@@ -852,13 +826,6 @@ func setEtcdPermissions(ctx context.Context, etcdHost *hosts.Host, prsMap map[st
852826
hostCfg := &container.HostConfig{
853827
Binds: []string{dataBind},
854828
}
855-
856-
if hosts.IsDockerSELinuxEnabled(etcdHost) {
857-
// We apply the label because we do not rewrite SELinux labels anymore on volume mounts (no :z)
858-
logrus.Debugf("Applying security opt label [%s] for [%s] container on host [%s]", SELinuxLabel, EtcdPermFixContainerName, etcdHost.Address)
859-
hostCfg.SecurityOpt = []string{SELinuxLabel}
860-
}
861-
862829
if err := docker.DoRunOnetimeContainer(ctx, etcdHost.DClient, imageCfg, hostCfg, EtcdPermFixContainerName,
863830
etcdHost.Address, ETCDRole, prsMap); err != nil {
864831
return err

‎services/services.go

-5
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ const (
5252

5353
ContainerNameLabel = "io.rancher.rke.container.name"
5454
MCSLabel = "label=level:s0:c1000,c1001"
55-
SELinuxLabel = "label=type:rke_container_t"
5655
)
5756

5857
type RestartFunc func(context.Context, *hosts.Host) error
@@ -143,10 +142,6 @@ func GetProcessConfig(process v3.Process, host *hosts.Host) (*container.Config,
143142
hostCfg.SecurityOpt = []string{MCSLabel}
144143
}
145144
}
146-
// We apply the label because we do not rewrite SELinux labels anymore on volume mounts (no :z)
147-
logrus.Debugf("Applying security opt label [%s] for etcd container on host [%s]", SELinuxLabel, host.Address)
148-
hostCfg.SecurityOpt = append(hostCfg.SecurityOpt, SELinuxLabel)
149-
150145
}
151146
return imageCfg, hostCfg, process.HealthCheck.URL
152147
}

0 commit comments

Comments
 (0)