github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-09-14 05:36:12 +00:00
Code Issues Projects Releases Wiki Activity

selinux: Ignore pods with Recursive policy

Browse Source 
Pod that explicitly opted into "seLinuxChangePolicy: Recursive" should not
report conflicts with another SELinux labels. They will only report a
conflict with other Pods using the same volume with "seLinuxChangePolicy:
Mount" (or nil).
This commit is contained in:
Jan Safranek
2025-02-25 16:32:26 +01:00
parent 4b12e89d0d
commit eeabc3ac6c
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/controller/volume/selinuxwarning/selinux_warning_controller.go
View File

@@ -451,10 +451,9 @@ func (c *Controller) syncPod(ctx context.Context, pod *v1.Pod) error {
continue
}
// Ignore how the volume is going to be mounted.
// Report any errors when a volume is used by two pods with different SELinux labels regardless of their
// SELinuxChangePolicy
seLinuxLabel := mountInfo.SELinuxProcessLabel
// Use the same label as kubelet will use for mount -o context.
// If the Pod has opted in to Recursive policy, it will be empty string here and no conflicts will be reported for it.
seLinuxLabel := mountInfo.SELinuxMountLabel
err = c.syncVolume(logger, pod, spec, seLinuxLabel, mountInfo.PluginSupportsSELinuxContextMount)
if err != nil {