How to grant read/write access through SELinux policy to a bind-mounted volume via rootless podman play kube?

Question

I recently switched from Docker to Podman and created a Kubernetes compliant pod definition yaml file.
The definition is loaded successful using rootless podman play kube command, then, declared Pod and container start but read access is denied when attempting to list content of hostPath bound volume within the container.

⋄ Loading the definition and dumping "front" container logs

$ podman play kube ./my-pod.yaml ; sleep 1 ; podman logs front
/var/www  # pwd
0 0       # echo `id -u` `id -g`
total 0   # ls -lha   
ls: cannot open '.': Permission denied

I believe the denial must have to do with SELinux restriction policy as file discretionary access control rights seem permissive enough on the host directory ...

$ pwd ; ls -lhaZ
/home/stph/my-project
drwxrwxr-x.  9 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr 15 22:30 .
drwxrwxr-x.  4 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr 15 22:30 ..
drwxr-xr-x.  5 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr  3 14:11 ui

So, I naively applied same SELinux labels from host directory to pod, but it apparently and unsurprisingly did not resolved anything.

There may be something about private labeling according to podman play kube documentation:

Note: HostPath volume types created by play kube will be given an SELinux private label

Which I believe only means that hostpath volumes cannot be shared by multiple containers (I might be mistaken here).

⋄ Podman pod yaml definition file

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  hostname: my-pod-host
  volumes:
  - name: projdir
    hostPath:
      path: /home/stph/my-project
      type: Directory
  securityContext:
    seLinuxOptions:
      level: s0
      role: object_r
      type: user_home_t
      user: unconfined_u
  containers:
  - name: front
    image: node:lts-alpine
    workingDir: /var/www
    env:
      - name: API_ENTRYPOINT
        value: "http://localhost:80/api"
    ports:
      - containerPort: 5000
        hostIP: 127.0.0.1
        hostPort: 5000
        protocol: TCP
    volumeMounts:
    - name: projdir
      mountPath: /var/www
      subPath: ui
    command: ['/bin/sh', '-c', 'pwd ; echo `id -u` `id -g` ; ls -lha']

⋄ /etc/subuid mappings

cat /etc/subuid
stph:1000:1
stph:100000:65536

⋄ Extract of podman inspect front output

{
  "Id": "c93a3d6...",
  "Created": "2020-04-15T19:01:14.034867742+02:00",
  "Path": "docker-entrypoint.sh",
  "Args": [
    "/bin/sh",
    "-c",
    "pwd ; echo `id -u` `id -g` ; ls -lha"
  ],
  "State": {
    "OciVersion": "1.0.1-dev",
    "Status": "exited",
    ...
  },
  "Image": "f77abbe...",
  "ImageName": "node:lts-alpine",
  "Rootfs": "",
  "Pod": "26bd784...",
  "ResolvConfPath": "/run/user/1000/containers/overlay-containers/93c4707.../userdata/resolv.conf",
  "HostnamePath": "/run/user/1000/containers/overlay-containers/c93a3d.../userdata/hostname",
  "HostsPath": "/run/user/1000/containers/overlay-containers/93c4707.../userdata/hosts",
  "StaticDir": ".../containers/storage/overlay-containers/c93a3d.../userdata",
  "OCIConfigPath": ".../containers/storage/overlay-containers/c93a3d.../userdata/config.json",
  "OCIRuntime": "crun",
  "LogPath": ".../containers/storage/overlay-containers/c93a3d.../userdata/ctr.log",
  "LogTag": "",
  "ConmonPidFile": "/run/user/1000/containers/overlay-containers/c93a3d.../userdata/conmon.pid",
  "Name": "front",
  "RestartCount": 0,
  "Driver": "overlay",
  "MountLabel": "system_u:object_r:container_file_t:s0:c57,c80",
  "ProcessLabel": "system_u:system_r:container_t:s0:c57,c80",
  "Mounts": [
    {
      "Type": "bind",
      "Name": "",
      "Source": "/home/stph/my-project",
      "Destination": "/var/www",
      "Driver": "",
      "Mode": "",
      "Options": [
          "rbind"
      ],
      "RW": true,
      "Propagation": "rprivate"
    }
  ],
  "Namespace": "",
  "IsInfra": false,
  "Config": {
    "Hostname": "ski-pod-host",
    "Domainname": "",
    "User": "",
    "AttachStdin": false,
    "AttachStdout": false,
    "AttachStderr": false,
    "Tty": false,
    "OpenStdin": false,
    "StdinOnce": false,
    "Env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
      "TERM=xterm",
      "NODE_VERSION=12.16.1",
      "YARN_VERSION=1.22.0",
      "API_ENTRYPOINT=http://localhost:80",
      "HOSTNAME=ski-pod-host",
      "HOME=/root",
      "container=libpod"
    ],
    "Cmd": [
      "docker-entrypoint.sh", "/bin/sh", "-c", "pwd ; echo `id -u` `id -g` ; ls -lha"
    ],
    "Image": "node:lts-alpine",
    "Volumes": null,
    "WorkingDir": "/var/www",
    "Entrypoint": "",
    "StopSignal": 15
    ...
  },
  "HostConfig": {
    "Binds": [
      "/home/stph/my-project:/var/www:rw,rprivate,rbind"
    ],
    "NetworkMode": "container:93c4707...",
    "RestartPolicy": {
      "Name": "",
      "MaximumRetryCount": 0
    },
    "AutoRemove": false,
    "VolumeDriver": "",
    "VolumesFrom": null,
    "IpcMode": "container:93c4707...",
    "Cgroup": "",
    "Cgroups": "default",
    "Privileged": false,
    "ReadonlyRootfs": false,
    "SecurityOpt": [],
    ...
  }
  ...
}

⋄ Related journalctl -a -r records do not show anything related to access denial nor unauthorized action.

Any suggestion on how to debug/resolve this situation? Thank you.

Answer 1

I had the same issue and I found this solution. Instead of trying to apply the same labels from the host, you just disable the labels:

  securityContext:
    seLinuxOptions:
      type: spc_t

The type: spc_t disable the SELinux's Label. It'd be the equivalent to run the command podman with the argument --security-opt label=disable. For example:

podman run -it --security-opt label=disable -v .:/foo alpine

I found the solution here: https://github.com/containers/libpod/pull/5307#issuecomment-590830455

I hope it helps.