brownz11
commented
1 year ago Can confirm this impacts RHEL8 as well. Downgrading to 0.14-1.el8 fixes it.
Open sfackler opened 1 year ago
brownz11
commented
1 year ago Can confirm this impacts RHEL8 as well. Downgrading to 0.14-1.el8 fixes it.
brownz11
commented
1 year ago While trying to reproduce I did find if you update container-selinux (for me from version2.205.0-2.module+el8.8.0+18438+15d3aa65. to version 2.205.0-2.module+el8.8.0+19993+47c8ef84), and then reinstall (or upgrade before even attempting to install) rke2-selinux0.15-1 everything is okay. So it may be 0.15-1 needs to have a dependency on a newer version of container-selinux
container-selinux.noarch 2:2.205.0-2.module+el8.8.0+19993+47c8ef84
rke2-selinux.noarch 0.15-1.el8
# ls -lZ /usr/bin/rke2
-rwxr-xr-x. 1 root root system_u:object_r:container_runtime_exec_t:s0 85604744 Sep 18 17:18 /usr/bin/rke2It appears updating container-selinux and then reinstalled rke2-selinux will break something and prevent context from being set correctly on some containers. If you've found yourself in a situation where pods are crashing due to SELinux denials, and the labeling seems off, you can purge all the images/snapshots from the node and force them to get repulled and labeled correctly
systemctl stop rke2-server
rke2-killall.sh
cd /var/lib/rancher/rke2/bin/
./containerd -c /var/lib/rancher/rke2/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/rke2/agent/containerd &
export CONTAINER_RUNTIME_ENDPOINT=unix:///run/k3s/containerd/containerd.sock
export CONTAINERD_ADDRESS=/run/k3s/containerd/containerd.sock
./crictl rmi -a
#Run this next command until it doesn't error
./ctr -n k8s.io snapshots ls | cut -d' ' -f 1 | grep -v "KEY" | xargs -i ./ctr -n k8s.io snapshots rm {} || true
./ctr -n k8s.io snapshots ls | cut -d' ' -f 1 | grep -v "KEY" | xargs -i ./ctr -n k8s.io snapshots rm {} || true
./ctr -n k8s.io snapshots ls | cut -d' ' -f 1 | grep -v "KEY" | xargs -i ./ctr -n k8s.io snapshots rm {} || true
fg
[CTRL-C]
skepickle
commented
11 months ago Can confirm that this impacts RHEL8.7 as well.
brownz11
commented
11 months ago After more digging, there appears to be a conflict between rke2-selinux and older versions of container-selinux.
The RKE2 installer will unload the RKE2 module (due to https://github.com/rancher/rke2/blob/87e1779357832973c26ea33ed636a7abb727c711/install.sh#L563) Try to install rke2-selinux It will fail to build it's module with an error about "Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/rke2/cil:63"
And then goes on to restorecon everything without the RKE2 module loaded, mislabeling everything.
This means the rke2 module never gets loaded back into the system.
Manually downgrading to 0.14 works: