hashicorp / hashicorp/nomad

docker: cannot mount /etc/localtime when using selinuxlabel

Open
#7,624 1 comment 0 reactions 0 assignees View on GitHub
theme/driver/docker theme/security type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

This is the issue for that fix: https://github.com/hashicorp/nomad/pull/7094

### Nomad version

Nomad v0.11.0-beta2 (4cf0ac5533e50d1ceba056e0c88b890d4c6d6f5a)

### Operating system and Environment details

Everything is in this Vagrant project.

```
Linux node 4.18.0-80.el8.x86_64 #1 SMP Tue Jun 4 09:19:46 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 31
```

### Issue

When SELinux is enabled on the Docker side, `/local` and `/secrets` don't have the labels, hence are unreadable.

Setting `selinuxlabel` makes then readable.

But it prevents from mounting non-relabelable volumes, such as `/etc/localtime`

### Reproduction steps

https://gitlab.com/greut/vagrant-nomad-selinux

### Job file (if appropriate)

```hcl
job "job" {
datacenters = ["dc1"]
type = "service"

group "group" {
task "task" {
driver = "docker"

config {
image = "python:3-slim"

args = [
"python", "-m", "http.server",
"--bind", "0.0.0.0",
"--directory", "/",
"80",
]

volumes = [
"/etc/localtime:/etc/localtime",
]
}

template {
data = < 2020-04-04T09:14:33.590Z [DEBUG] client.driver_mgr.docker: failed to start container: driver=docker container_id=752131b8c5a9a97f2157d65c19d9270739e74a03673c21f7388a82c3f1ebb004 attempt=3 error="API error (500
): error setting label on mount source '/usr/share/zoneinfo/UTC': relabeling content in /usr is not allowed"

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the linked pull request 7094 and the Vagrant reproduction project, then review Nomad's Docker driver handling of the provided job file and the client log showing the SELinux relabeling failure. Done means the reproduction no longer fails when /etc/localtime is mounted while selinuxlabel is used, while /local and /secrets remain readable.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.