Conversation
Pods (and other involved components) need NFS (and similar network FS) access when provisioning using CSI drivers that use NFS. Link: siderolabs#13938 (not a complete fix) Signed-off-by: Dmitrii Sharshakov <dmitry.sharshakov@siderolabs.com>
| (allow any_p hugetlbfs_t (fs_classes (rw))) | ||
|
|
||
| ; NFS and others, frequently used by CSI drivers | ||
| (allow any_p network_fs_t (fs_classes (rw))) |
There was a problem hiding this comment.
shouldn't we only allow containers?
There was a problem hiding this comment.
I suspect there might be other edge cases where e.g. kubelet needs to interact with the CSI-provisioned volumes. I have not reproduced this issue myself
There was a problem hiding this comment.
we could check the audit logs of the longhorn test, it tests an NFS mount
There was a problem hiding this comment.
Could not find any mentions of network_fs_t there, maybe because it's permissive (?)
There was a problem hiding this comment.
yeh it's permissive, but there should be logging for denials right?
There was a problem hiding this comment.
I'm more inclined we reproduce this with some NFS test and rule out a bad program behavior if possible
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds an SELinux policy allow-rule to enable filesystem RW access to network-backed filesystems (e.g., NFS) that are commonly used by CSI drivers.
Changes:
- Allow
any_pprocesses RW access tonetwork_fs_tacross filesystem classes. - Document the intent with an inline policy comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ; NFS and others, frequently used by CSI drivers | ||
| (allow any_p network_fs_t (fs_classes (rw))) |
|
@shanduur did your NFS PR contain a similar fix for the SELinux policy? |
Pods (and other involved components) need NFS (and similar network FS) access when provisioning using CSI drivers that use NFS.
Link: #13938 (not a complete fix)