search

k3s-io / k3s-selinux

SELinux policy for k3s
Apache License 2.0
66 stars 20 forks source link

Privileged containers run as container_runtime_t instead of spc_t on MicroOS #53

Open ejweber opened 9 months ago

ejweber commented 9 months ago

Found this while investigating https://github.com/longhorn/longhorn/issues/5348#issuecomment-1812677123.

I am technically using Tumbleweed, not MicroOS, but I am able to match the package versions of the initial raiser.

To be honest, I'm not really sure if this is a k3s-selinux bug or a selinux-policy-targeted bug. I tried to reproduce on RKE2, but I hit https://github.com/rancher/rke2-selinux/issues/56 for now.

The problem manifests when upgrading selinux-policy-targeted from 20231012-1.1 to 120231030-1.1.

Before the upgrade, privileged containers run correctly in the spc_t domain.

ip-192-168-217-136:/home/ec2-user # tumbleweed version
20231030

ip-192-168-217-136:/home/ec2-user # zypper search -si selinux
Loading repository data...
Reading installed packages...

S  | Name                     | Type    | Version          | Arch   | Repository
---+--------------------------+---------+------------------+--------+-----------------------------------
i+ | container-selinux        | package | 2.222.0-1.2      | noarch | openSUSE-Tumbleweed-Oss (20231030)
i+ | k3s-selinux              | package | 1.4.stable.1-1.3 | noarch | openSUSE-Tumbleweed-Oss (20231030)
i  | libselinux1              | package | 3.5-5.2          | x86_64 | openSUSE-Tumbleweed-Oss (20231030)
i  | microos_selinux          | pattern | 5.0-81.1         | x86_64 | (System Packages)
i+ | patterns-microos-selinux | package | 5.0-81.1         | x86_64 | (System Packages)
i  | python311-selinux        | package | 3.5-5.2          | x86_64 | openSUSE-Tumbleweed-Oss (20231030)
i  | selinux-autorelabel      | package | 3.1-3.9          | noarch | openSUSE-Tumbleweed-Oss (20231030)
i+ | selinux-policy           | package | 20231012-1.1     | noarch | openSUSE-Tumbleweed-Oss (20231030)
i  | selinux-policy-devel     | package | 20231030-1.1     | noarch | (System Packages)
i+ | selinux-policy-targeted  | package | 20231012-1.1     | noarch | openSUSE-Tumbleweed-Oss (20231030)
i  | selinux-tools            | package | 3.5-5.2          | x86_64 | openSUSE-Tumbleweed-Oss (20231030)

ip-192-168-217-136:/home/ec2-user # ps -efZ | grep "longhorn-manager -d csi"
system_u:system_r:spc_t:s0      root     12788  4678  0 19:27 ?        00:00:00 longhorn-manager -d csi --nodeid=ip-192-168-217-136 --endpoint=unix:///csi/csi.sock --drivername=driver.longhorn.io --manager-url=http://longhorn-backend:9500/v1
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 22254 17226  0 19:42 pts/1 00:00:00 grep --color=auto longhorn-manager -d csi

ip-192-168-217-136:/home/ec2-user # ps -efZ | grep "pause"
system_u:system_r:container_t:s0:c311,c885 65535 2308 2148  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c337,c548 65535 2323 2162  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c289,c892 65535 2580 2395  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c591,c694 65535 3028 2737  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c683,c711 65535 3094 2755  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c802,c836 65535 3112 2878  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c298,c963 65535 3243 3029  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c465,c934 65532 3250 3068  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c447,c862 65535 3520 3404  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c455,c839 65535 3523 3303  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c405,c908 root 3621 3414  0 19:26 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c400,c525 65535 3722 3512  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c160,c677 65535 3966 3718  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c132,c522 65535 4049 3850  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c96,c539 65535 4081 3856  0 19:26 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c57,c457 65535 4092 3821  0 19:26 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c20,c927 65535 4161 3989  0 19:26 ?   00:00:00 /pause
system_u:system_r:spc_t:s0      65535     4403  4131  0 19:26 ?        00:00:00 /pause
system_u:system_r:container_t:s0:c703,c910 65535 4554 4306  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c623,c860 65535 4562 4418  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c28,c545 65535 4799 4654  0 19:26 ?   00:00:00 /pause
system_u:system_r:spc_t:s0      65535     4850  4678  0 19:26 ?        00:00:00 /pause
system_u:system_r:spc_t:s0      65535     4924  4794  0 19:26 ?        00:00:00 /pause
system_u:system_r:container_t:s0:c559,c630 65535 5042 4832  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c229,c625 65535 5228 5169  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c609,c795 65535 5603 5486  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c203,c988 65535 6102 6001  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c384,c827 65535 6163 6075  0 19:26 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c451,c720 65535 6391 6325  0 19:26 ?  00:00:00 /pause
system_u:system_r:spc_t:s0      65535     9407  9340  0 19:27 ?        00:00:00 /pause
system_u:system_r:spc_t:s0      65535     9414  9379  0 19:27 ?        00:00:00 /pause
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 22313 17226 99 19:42 pts/1 00:00:00 grep --color=auto pause

After the upgrade, they stay in the container_runtime_t domain. This is the root cause of https://github.com/longhorn/longhorn/issues/5348#issuecomment-1812677123.

ip-192-168-217-136:/home/ec2-user # tumbleweed version
repositories have not been initialized for snapshots
  Try /usr/bin/tumbleweed init

ip-192-168-217-136:/home/ec2-user # zypper search -si selinux
Loading repository data...
Reading installed packages...

S  | Name                     | Type    | Version          | Arch   | Repository
---+--------------------------+---------+------------------+--------+------------------------
i+ | container-selinux        | package | 2.222.0-1.2      | noarch | openSUSE-Tumbleweed-Oss
i+ | k3s-selinux              | package | 1.4.stable.1-1.3 | noarch | openSUSE-Tumbleweed-Oss
i  | libselinux1              | package | 3.5-5.2          | x86_64 | openSUSE-Tumbleweed-Oss
i  | microos_selinux          | pattern | 5.0-81.1         | x86_64 | openSUSE-Tumbleweed-Oss
i+ | patterns-microos-selinux | package | 5.0-81.1         | x86_64 | openSUSE-Tumbleweed-Oss
i  | python311-selinux        | package | 3.5-5.2          | x86_64 | openSUSE-Tumbleweed-Oss
i  | selinux-autorelabel      | package | 3.1-3.9          | noarch | openSUSE-Tumbleweed-Oss
i+ | selinux-policy           | package | 20231030-1.1     | noarch | openSUSE-Tumbleweed-Oss
i  | selinux-policy-devel     | package | 20231030-1.1     | noarch | openSUSE-Tumbleweed-Oss
i+ | selinux-policy-targeted  | package | 20231030-1.1     | noarch | openSUSE-Tumbleweed-Oss
i  | selinux-tools            | package | 3.5-5.2          | x86_64 | openSUSE-Tumbleweed-Oss

    Note: For an extended search including not yet activated remote resources please use 'zypper
    search-packages'.

ip-192-168-217-136:/home/ec2-user # ps -efZ | grep "longhorn-manager -d csi"
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 29151 25465  0 00:30 pts/1 00:00:00 grep --color=auto longhorn-manager -d csi

ip-192-168-217-136:/home/ec2-user # ps -efZ | grep "longhorn-manager -d csi"
system_u:system_r:container_runtime_t:s0 root 31026 30576  0 00:32 ?   00:00:00 longhorn-manager -d csi --nodeid=ip-192-168-217-136 --endpoint=unix:///csi/csi.sock --drivername=driver.longhorn.io --manager-url=http://longhorn-backend:9500/v1
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 31183 25465  0 00:32 pts/1 00:00:00 grep --color=auto longhorn-manager -d csi

ip-192-168-217-136:/home/ec2-user # ps -efZ | grep "pause"
system_u:system_r:container_t:s0:c231,c334 65535 2052 1848  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c58,c588 65535 2126 1927  0 Nov20 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c271,c689 65535 2263 2200  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c93,c477 65535 2382 2217  0 Nov20 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c26,c585 65535 2423 2301  0 Nov20 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c97,c648 65535 2427 2315  0 Nov20 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c142,c669 65535 2453 2311  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c418,c835 65535 2455 2347  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c641,c771 65535 2621 2554  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c226,c315 65532 2770 2679  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c109,c281 65535 3132 3062  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c209,c349 65535 3146 3079  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_runtime_t:s0 65535 3545 3474  0 Nov20 ?    00:00:00 /pause
system_u:system_r:container_t:s0:c308,c406 65535 3872 3766  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c126,c599 65535 3884 3837  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c115,c166 65535 4069 4018  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c242,c711 65535 4550 4458  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c254,c998 65535 4696 4625  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c175,c609 65535 4888 4793  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c467,c864 65535 5164 5003  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c548,c562 root 5356 5192  0 Nov20 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c207,c515 65535 5795 5659  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c29,c545 65535 5845 5646  0 Nov20 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c144,c888 65535 5951 5842  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_t:s0:c33,c413 65535 6033 5866  0 Nov20 ?   00:00:00 /pause
system_u:system_r:container_t:s0:c748,c926 65535 6134 6040  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_runtime_t:s0 65535 6630 6556  0 Nov20 ?    00:00:00 /pause
system_u:system_r:container_t:s0:c725,c738 65535 6821 6769  0 Nov20 ?  00:00:00 /pause
system_u:system_r:container_runtime_t:s0 65535 9132 9082  0 Nov20 ?    00:00:00 /pause
system_u:system_r:container_runtime_t:s0 65535 9143 9100  0 Nov20 ?    00:00:00 /pause
system_u:system_r:container_runtime_t:s0 65535 30607 30576  0 00:32 ?  00:00:00 /pause

Other context:

k3s version: v1.27.7+k3s2

OS distribution:

ip-192-168-217-136:~ # cat /etc/os-release
NAME="openSUSE Tumbleweed"
# VERSION="20231119"
ID="opensuse-tumbleweed"
ID_LIKE="opensuse suse"
VERSION_ID="20231119"
PRETTY_NAME="openSUSE Tumbleweed"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:tumbleweed:20231119"
BUG_REPORT_URL="https://bugzilla.opensuse.org"
SUPPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed"
LOGO="distributor-logo-Tumbleweed"