cri: selinuxrelabel=false for /dev/shm w/ host ipc

dweomer · dweomer · commit a1e7dd939de7 · 2020-11-11T15:22:17.000-07:00
This is a followup to #4699 that addresses an oversight that could cause the CRI to relabel the host /dev/shm, which should be a no-op in most cases. Additionally, fixes unit tests to make correct assertions for /dev/shm relabeling. Discovered while applying the changes for #4699 to containerd/cri 1.4: containerd/cri#1605 Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
diff --git a/pkg/cri/server/container_create_linux.go b/pkg/cri/server/container_create_linux.go
@@ -102,7 +102,7 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
 			ContainerPath:  devShm,
 			HostPath:       sandboxDevShm,
 			Readonly:       false,
-			SelinuxRelabel: true,
+			SelinuxRelabel: sandboxDevShm != devShm,
 		})
 	}
 	return mounts
diff --git a/pkg/cri/server/container_create_linux_test.go b/pkg/cri/server/container_create_linux_test.go
@@ -455,9 +455,10 @@ func TestContainerMounts(t *testing.T) {
 					Readonly:      true,
 				},
 				{
-					ContainerPath: "/dev/shm",
-					HostPath:      filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
-					Readonly:      false,
+					ContainerPath:  "/dev/shm",
+					HostPath:       filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
+					Readonly:       false,
+					SelinuxRelabel: true,
 				},
 			},
 		},
@@ -480,9 +481,10 @@ func TestContainerMounts(t *testing.T) {
 					Readonly:      false,
 				},
 				{
-					ContainerPath: "/dev/shm",
-					HostPath:      filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
-					Readonly:      false,
+					ContainerPath:  "/dev/shm",
+					HostPath:       filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
+					Readonly:       false,
+					SelinuxRelabel: true,
 				},
 			},
 		},
@@ -553,9 +555,10 @@ func TestContainerMounts(t *testing.T) {
 					Readonly:      false,
 				},
 				{
-					ContainerPath: "/dev/shm",
-					HostPath:      filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
-					Readonly:      false,
+					ContainerPath:  "/dev/shm",
+					HostPath:       filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
+					Readonly:       false,
+					SelinuxRelabel: true,
 				},
 			},
 		},

Original file line number	Diff line number	Diff line change
`@@ -102,7 +102,7 @@ func (c criService) containerMounts(sandboxID string, config runtime.Container`
`102`	`102`	`ContainerPath: devShm,`
`103`	`103`	`HostPath: sandboxDevShm,`
`104`	`104`	`Readonly: false,`
`105`		`- SelinuxRelabel: true,`
	`105`	`+ SelinuxRelabel: sandboxDevShm != devShm,`
`106`	`106`	`})`
`107`	`107`	`}`
`108`	`108`	`return mounts`