fix: improve rsync tunnel reliability and mover pod security

Fix race-free premature-exit detection in rsync daemon using channel-based
select instead of signal probing. Increase max connections from 4 to 8. Add
munge symlinks and SELinux label/numeric ID sync for rsync passes. Add SCC
rules for mover pods.

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: Rakshith R <rar@redhat.com>

Author: Rakshith-R

cmd/manager/openshift/mover_scc.yaml

@@ -26,6 +26,8 @@ runAsUser:
   type: RunAsAny  # allow mover to run as root
 seLinuxContext:
   type: MustRunAs
+  seLinuxOptions:
+    type: spc_t
 seccompProfiles:
   - runtime/default
 supplementalGroups:

internal/worker/tunnel/rsync.go

@@ -37,6 +37,7 @@ type RsyncDaemon struct {
 	port   string
 	cmd    *exec.Cmd
 	logger logr.Logger
+	exitCh chan error
 }
 
 // NewRsyncDaemon creates a new RsyncDaemon manager.
@@ -79,12 +80,24 @@ func (r *RsyncDaemon) Start() error {
 		)
 	}
 
+	// Background goroutine reaps the daemon process,
+	// preventing zombies if it exits before Stop().
+	r.exitCh = make(chan error, 1)
+	go func() {
+		r.exitCh <- r.cmd.Wait()
+	}()
+
 	// Wait for rsync daemon to initialize
 	time.Sleep(2 * time.Second)
 
-	// Check if it's still running
-	if err := r.cmd.Process.Signal(syscall.Signal(0)); err != nil {
-		return fmt.Errorf("rsync daemon exited prematurely: %w", err)
+	// Check if it exited during startup
+	select {
+	case err := <-r.exitCh:
+		if err != nil {
+			return fmt.Errorf("rsync daemon exited prematurely: %w", err)
+		}
+		return fmt.Errorf("rsync daemon exited prematurely")
+	default:
 	}
 
 	r.logger.Info(
@@ -112,15 +125,22 @@ func (r *RsyncDaemon) Stop() {
 		)
 	}
 
-	_ = r.cmd.Wait()
+	if r.exitCh != nil {
+		// Non-blocking: exitCh may already be drained if
+		// daemon exited prematurely during startup check.
+		select {
+		case <-r.exitCh:
+		default:
+		}
+	}
 }
 
 func (r *RsyncDaemon) generateConfig() error {
 	conf := `# Rsync daemon configuration
 uid = root
 gid = root
 use chroot = no
-max connections = 4
+max connections = 8
 pid file = /tmp/rsyncd.pid
 log file = /tmp/rsyncd.log
 lock file = /tmp/rsyncd.lock
@@ -130,6 +150,7 @@ lock file = /tmp/rsyncd.lock
     comment = Data volume
     read only = false
     list = yes
+    munge symlinks = no
     # No authentication - stunnel already provides PSK authentication
 `
 	return os.WriteFile(rsyncdConf, []byte(conf), 0600)

internal/worker/tunnel/stunnel_test.go

@@ -28,13 +28,15 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const testDestAddr = "10.0.0.1"
+
 func TestWriteSourceConfig_UsesUDS(t *testing.T) {
 	// Clean up any existing config from previous tests
 	_ = os.RemoveAll(stunnelDir)
 
 	cfg := StunnelConfig{
-		WorkerType:         "source",
-		DestinationAddress: "10.0.0.1",
+		WorkerType:         workerTypeSource,
+		DestinationAddress: testDestAddr,
 		DestinationPort:    "8000",
 		EnableRsyncTunnel:  true,
 		RsyncPort:          "8873",
@@ -115,8 +117,8 @@ func TestWriteDestinationConfig_StaysTCP(t *testing.T) {
 
 func TestSourceGRPCAddress_ReturnsUnixScheme(t *testing.T) {
 	cfg := StunnelConfig{
-		WorkerType:         "source",
-		DestinationAddress: "10.0.0.1",
+		WorkerType:         workerTypeSource,
+		DestinationAddress: testDestAddr,
 		DestinationPort:    "8000",
 	}
 
@@ -135,8 +137,8 @@ func TestCheckSocket_ExistingSocket(t *testing.T) {
 	socketPath := filepath.Join(tempDir, "test.sock")
 
 	cfg := StunnelConfig{
-		WorkerType:         "source",
-		DestinationAddress: "10.0.0.1",
+		WorkerType:         workerTypeSource,
+		DestinationAddress: testDestAddr,
 		DestinationPort:    "8000",
 	}
 
@@ -169,8 +171,8 @@ func TestCheckSocket_NonexistentSocket(t *testing.T) {
 	socketPath := filepath.Join(tempDir, "nonexistent.sock")
 
 	cfg := StunnelConfig{
-		WorkerType:         "source",
-		DestinationAddress: "10.0.0.1",
+		WorkerType:         workerTypeSource,
+		DestinationAddress: testDestAddr,
 		DestinationPort:    "8000",
 	}