selinux not working under containerd with selinux-enable=true

Question

I have two k8s cluster, one using docker and another using containerd directly, both with selinux enabled. but I found selinux not actually working on the containerd one, although this two cluster have the same version of containerd and runc.

did i miss some setting with containerd?

docker: file label is container_file_t, and process runs as container_t, selinux works fine

K8s version: 1.17
Docker version: 19.03.6
Containerd version: 1.2.10
selinux enable by adding ["selinux-enabled": true] to /etc/docker/daemon.json

// create pod using tomcat official image then check the process and file label
# kubectl exec tomcat -it -- ps -eZ
LABEL                             PID TTY          TIME CMD
system_u:system_r:container_t:s0:c655,c743          1 ?        00:00:00 java

# ls -Z /usr/local/openjdk-8/bin/java
system_u:object_r:container_file_t:s0:c655,c743 /usr/local/openjdk-8/bin/java

containerd: file label is container_var_lib_t, and process runs as spc_t, selinux makes no sense

K8s version: 1.15
Containerd version: 1.2.10
selinux enable by setting [enable_selinux = true] in /etc/containerd/config.toml

// create pod using tomcat official image then check the process and file label
# kubectl exec tomcat -it -- ps -eZ
LABEL                             PID TTY          TIME CMD
system_u:system_r:spc_t:s0          1 ?        00:00:00 java

# ls -Z /usr/local/openjdk-8/bin/java
system_u:object_r:container_var_lib_t:s0 /usr/local/openjdk-8/bin/java

// seems run as spc_t is correct
# sesearch -T -t container_var_lib_t | grep spc_t
   type_transition container_runtime_t container_var_lib_t : process spc_t;

score 1 · Answer 1 · answered Apr 14 '20 at 13:34

From this issue we can read:

Containerd includes minimal support for SELinux. More accurately, it contains support to run ON systems using SELinux, but it does not make use of SELinux to improve container security.

All containers run with the system_u:system_r:container_runtime_t:s0 label, but no further segmentation is made

There is no full support for what you are doing using Containerd. Your approach is correct but the problem is lack of support to this functionality.

selinux not working under containerd with selinux-enable=true

1 Answers1