github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-24 20:24:09 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #113411 from jsafrane/fix-selinux-context-mount

Browse Source 
Fix SELinux context mount with unknown context
This commit is contained in:
Kubernetes Prow Robot 2022-10-31 17:00:44 -07:00 committed by GitHub
commit 7d9c0e0a78
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/volume/csi/csi_attacher.go
View File

@ -377,7 +377,7 @@ func (c *csiAttacher) MountDevice(spec *volume.Spec, devicePath string, deviceMo
if err != nil { if err != nil {
return errors.New(log("failed to query for SELinuxMount support: %s", err)) return errors.New(log("failed to query for SELinuxMount support: %s", err))
} }
if support { if support && deviceMounterArgs.SELinuxLabel != "" {
mountOptions = util.AddSELinuxMountOption(mountOptions, deviceMounterArgs.SELinuxLabel) mountOptions = util.AddSELinuxMountOption(mountOptions, deviceMounterArgs.SELinuxLabel)
} }
} }

2
pkg/volume/csi/csi_mounter.go
View File

@ -259,7 +259,7 @@ func (c *csiMountMgr) SetUpAt(dir string, mounterArgs volume.MounterArgs) error
if err != nil { if err != nil {
return errors.New(log("failed to query for SELinuxMount support: %s", err)) return errors.New(log("failed to query for SELinuxMount support: %s", err))
} }
if support { if support && mounterArgs.SELinuxLabel != "" {
mountOptions = util.AddSELinuxMountOption(mountOptions, mounterArgs.SELinuxLabel) mountOptions = util.AddSELinuxMountOption(mountOptions, mounterArgs.SELinuxLabel)
selinuxLabelMount = true selinuxLabelMount = true
} }

9
pkg/volume/csi/csi_mounter_test.go
View File

@ -200,6 +200,15 @@ func TestMounterSetUp(t *testing.T) {
enableSELinuxFeatureGate: true, enableSELinuxFeatureGate: true,
expectedVolumeContext: nil, expectedVolumeContext: nil,
}, },
{
name: "should not include selinux mount options, if feature gate is enabled, driver supports it, but Pod does not have it",
driver: "supports_selinux",
seLinuxLabel: "",
expectedSELinuxContext: "", // especially make sure the volume plugin does not use -o context="", that is an invalid value
volumeContext: nil,
enableSELinuxFeatureGate: true,
expectedVolumeContext: nil,
},
} }
noPodMountInfo := false noPodMountInfo := false