github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-31 23:37:01 +00:00
Code Issues Projects Releases Wiki Activity

Fix SELinux context mount with unknown context

Browse Source 
Don't mount with SELinux mount option if kubelet does not know the SELinux
context, i.e. MounterArgs.SELinuxLabel is ""
This commit is contained in:
Jan Safranek 2022-10-27 19:04:34 +02:00
parent 7ad4b04632
commit 8dd3510032
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/volume/csi/csi_attacher.go
View File

@ -377,7 +377,7 @@ func (c *csiAttacher) MountDevice(spec *volume.Spec, devicePath string, deviceMo
if err != nil {
return errors.New(log("failed to query for SELinuxMount support: %s", err))
}
if support {
if support && deviceMounterArgs.SELinuxLabel != "" {
mountOptions = util.AddSELinuxMountOption(mountOptions, deviceMounterArgs.SELinuxLabel)
}
}

2
pkg/volume/csi/csi_mounter.go
View File

@ -249,7 +249,7 @@ func (c *csiMountMgr) SetUpAt(dir string, mounterArgs volume.MounterArgs) error
if err != nil {
return errors.New(log("failed to query for SELinuxMount support: %s", err))
}
if support {
if support && mounterArgs.SELinuxLabel != "" {
mountOptions = util.AddSELinuxMountOption(mountOptions, mounterArgs.SELinuxLabel)
selinuxLabelMount = true
}

9
pkg/volume/csi/csi_mounter_test.go
View File

@ -182,6 +182,15 @@ func TestMounterSetUp(t *testing.T) {
enableSELinuxFeatureGate: true,
expectedVolumeContext: nil,
},
{
name: "should not include selinux mount options, if feature gate is enabled, driver supports it, but Pod does not have it",
driver: "supports_selinux",
seLinuxLabel: "",
expectedSELinuxContext: "", // especially make sure the volume plugin does not use -o context="", that is an invalid value
volumeContext: nil,
enableSELinuxFeatureGate: true,
expectedVolumeContext: nil,
},
}
noPodMountInfo := false