☰

如何透過 SELinux 策略向透過 rootless podman play kube 綁定安裝的磁碟區授予讀取/寫入存取權限？

tag-icon • tag-icon container podman
如何透過 SELinux 策略向透過 rootless podman play kube 綁定安裝的磁碟區授予讀取/寫入存取權限？

我最近從 Docker 切換到波德曼並創建了一個與 Kubernetes 相容的吊艙定義yaml 檔。
使用 rootless 成功載入定義podman play kube然後，命令聲明 Pod 和容器啟動，但是讀取訪問被拒絕當嘗試列出內容時主機路徑容器內的束縛體積。

⋄載入定義並轉儲“前端”容器日誌

$ podman play kube ./my-pod.yaml ; sleep 1 ; podman logs front
/var/www  # pwd
0 0       # echo `id -u` `id -g`
total 0   # ls -lha   
ls: cannot open '.': Permission denied

我相信否認一定與SELinux限制策略，因為檔案自主存取控制權限在主機目錄上似乎足夠寬鬆...

$ pwd ; ls -lhaZ
/home/stph/my-project
drwxrwxr-x.  9 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr 15 22:30 .
drwxrwxr-x.  4 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr 15 22:30 ..
drwxr-xr-x.  5 stph stph unconfined_u:object_r:user_home_t:s0 4.0K Apr  3 14:11 ui

所以，我天真地應用了同樣的SELinux標籤從主機目錄到 pod，但顯然並且不出所料，它沒有解決任何問題。

根據，可能會有一些關於私人標籤的事情podman 玩 kube文件：

注意：HostPath 磁碟區類型建立者玩庫貝將被給予SELinux私人標籤

我相信這只意味著主機路徑卷不能由多個容器共享（我在這裡可能會弄錯）。

⋄Podman pod yaml 定義文件

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  hostname: my-pod-host
  volumes:
  - name: projdir
    hostPath:
      path: /home/stph/my-project
      type: Directory
  securityContext:
    seLinuxOptions:
      level: s0
      role: object_r
      type: user_home_t
      user: unconfined_u
  containers:
  - name: front
    image: node:lts-alpine
    workingDir: /var/www
    env:
      - name: API_ENTRYPOINT
        value: "http://localhost:80/api"
    ports:
      - containerPort: 5000
        hostIP: 127.0.0.1
        hostPort: 5000
        protocol: TCP
    volumeMounts:
    - name: projdir
      mountPath: /var/www
      subPath: ui
    command: ['/bin/sh', '-c', 'pwd ; echo `id -u` `id -g` ; ls -lha']

⋄/etc/subuid 映射

cat /etc/subuid
stph:1000:1
stph:100000:65536

⋄podman inspect front輸出摘錄

{
  "Id": "c93a3d6...",
  "Created": "2020-04-15T19:01:14.034867742+02:00",
  "Path": "docker-entrypoint.sh",
  "Args": [
    "/bin/sh",
    "-c",
    "pwd ; echo `id -u` `id -g` ; ls -lha"
  ],
  "State": {
    "OciVersion": "1.0.1-dev",
    "Status": "exited",
    ...
  },
  "Image": "f77abbe...",
  "ImageName": "node:lts-alpine",
  "Rootfs": "",
  "Pod": "26bd784...",
  "ResolvConfPath": "/run/user/1000/containers/overlay-containers/93c4707.../userdata/resolv.conf",
  "HostnamePath": "/run/user/1000/containers/overlay-containers/c93a3d.../userdata/hostname",
  "HostsPath": "/run/user/1000/containers/overlay-containers/93c4707.../userdata/hosts",
  "StaticDir": ".../containers/storage/overlay-containers/c93a3d.../userdata",
  "OCIConfigPath": ".../containers/storage/overlay-containers/c93a3d.../userdata/config.json",
  "OCIRuntime": "crun",
  "LogPath": ".../containers/storage/overlay-containers/c93a3d.../userdata/ctr.log",
  "LogTag": "",
  "ConmonPidFile": "/run/user/1000/containers/overlay-containers/c93a3d.../userdata/conmon.pid",
  "Name": "front",
  "RestartCount": 0,
  "Driver": "overlay",
  "MountLabel": "system_u:object_r:container_file_t:s0:c57,c80",
  "ProcessLabel": "system_u:system_r:container_t:s0:c57,c80",
  "Mounts": [
    {
      "Type": "bind",
      "Name": "",
      "Source": "/home/stph/my-project",
      "Destination": "/var/www",
      "Driver": "",
      "Mode": "",
      "Options": [
          "rbind"
      ],
      "RW": true,
      "Propagation": "rprivate"
    }
  ],
  "Namespace": "",
  "IsInfra": false,
  "Config": {
    "Hostname": "ski-pod-host",
    "Domainname": "",
    "User": "",
    "AttachStdin": false,
    "AttachStdout": false,
    "AttachStderr": false,
    "Tty": false,
    "OpenStdin": false,
    "StdinOnce": false,
    "Env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
      "TERM=xterm",
      "NODE_VERSION=12.16.1",
      "YARN_VERSION=1.22.0",
      "API_ENTRYPOINT=http://localhost:80",
      "HOSTNAME=ski-pod-host",
      "HOME=/root",
      "container=libpod"
    ],
    "Cmd": [
      "docker-entrypoint.sh", "/bin/sh", "-c", "pwd ; echo `id -u` `id -g` ; ls -lha"
    ],
    "Image": "node:lts-alpine",
    "Volumes": null,
    "WorkingDir": "/var/www",
    "Entrypoint": "",
    "StopSignal": 15
    ...
  },
  "HostConfig": {
    "Binds": [
      "/home/stph/my-project:/var/www:rw,rprivate,rbind"
    ],
    "NetworkMode": "container:93c4707...",
    "RestartPolicy": {
      "Name": "",
      "MaximumRetryCount": 0
    },
    "AutoRemove": false,
    "VolumeDriver": "",
    "VolumesFrom": null,
    "IpcMode": "container:93c4707...",
    "Cgroup": "",
    "Cgroups": "default",
    "Privileged": false,
    "ReadonlyRootfs": false,
    "SecurityOpt": [],
    ...
  }
  ...
}

⋄相關journalctl -a -r記錄不顯示任何與拒絕存取或未經授權的操作相關的內容。

關於如何調試/解決這種情況有什麼建議嗎？謝謝。

答案1

我有同樣的問題，我找到了這個解決方案。您無需嘗試從主機套用相同的標籤，只需停用標籤即可：

  securityContext:
    seLinuxOptions:
      type: spc_t

停用type: spc_tSELinux 的標籤。這相當於使用podman參數運行命令--security-opt label=disable。例如：

podman run -it --security-opt label=disable -v .:/foo alpine

我在這裡找到了解決方案：https://github.com/containers/libpod/pull/5307#issuecomment-590830455

我希望它有幫助。

相關內容