kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Restore default SELinux security contexts for container runtime binaries

This commit is contained in:
Ciprian Hacman 2020-07-16 18:54:34 +03:00
parent c6c9e8ae54
commit 234149559b
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
nodeup/pkg/model/containerd.go
View File

@ -265,6 +265,12 @@ func (b *ContainerdBuilder) buildSystemdService() *nodetasks.Service {
manifest.Set("Unit", "Documentation", "https://containerd.io") manifest.Set("Unit", "Documentation", "https://containerd.io")
manifest.Set("Unit", "After", "network.target local-fs.target") manifest.Set("Unit", "After", "network.target local-fs.target")
// Restore the default SELinux security contexts for the containerd and runc binaries
if b.Distribution.IsRHELFamily() && b.Cluster.Spec.Docker != nil && fi.BoolValue(b.Cluster.Spec.Docker.SelinuxEnabled) {
manifest.Set("Service", "ExecStartPre", "/bin/sh -c 'restorecon -v /usr/bin/runc'")
manifest.Set("Service", "ExecStartPre", "/bin/sh -c 'restorecon -v /usr/bin/containerd*'")
}
manifest.Set("Service", "EnvironmentFile", "/etc/sysconfig/containerd") manifest.Set("Service", "EnvironmentFile", "/etc/sysconfig/containerd")
manifest.Set("Service", "EnvironmentFile", "/etc/environment") manifest.Set("Service", "EnvironmentFile", "/etc/environment")
manifest.Set("Service", "ExecStartPre", "-/sbin/modprobe overlay") manifest.Set("Service", "ExecStartPre", "-/sbin/modprobe overlay")

5
nodeup/pkg/model/docker.go
View File

@ -558,6 +558,11 @@ func (b *DockerBuilder) buildSystemdService(dockerVersion semver.Version) *nodet
manifest.Set("Service", "EnvironmentFile", "/etc/sysconfig/docker") manifest.Set("Service", "EnvironmentFile", "/etc/sysconfig/docker")
manifest.Set("Service", "EnvironmentFile", "/etc/environment") manifest.Set("Service", "EnvironmentFile", "/etc/environment")
// Restore the default SELinux security contexts for the Docker binaries
if b.Distribution.IsRHELFamily() && b.Cluster.Spec.Docker != nil && fi.BoolValue(b.Cluster.Spec.Docker.SelinuxEnabled) {
manifest.Set("Service", "ExecStartPre", "/bin/sh -c 'restorecon -v /usr/bin/docker*'")
}
// the default is not to use systemd for cgroups because the delegate issues still // the default is not to use systemd for cgroups because the delegate issues still
// exists and systemd currently does not support the cgroup feature set required // exists and systemd currently does not support the cgroup feature set required
// for containers run by docker // for containers run by docker