From 6b900d8db02c7bf235776cc09b3bce495d371b54 Mon Sep 17 00:00:00 2001 From: Teoman ONAY Date: Tue, 14 Mar 2023 12:26:56 +0100 Subject: [PATCH] Fix selinux label issues Add --security-opt label=disable to all containers accessing /var/lib/ceph. podman selinux relabeling behavious changed since version podman-3:4.2.0-1 which prevent some containers to access files in these subdirectories. Signed-off-by: Teoman ONAY --- roles/ceph-crash/templates/ceph-crash.service.j2 | 1 + roles/ceph-mds/templates/ceph-mds.service.j2 | 1 + roles/ceph-mgr/templates/ceph-mgr.service.j2 | 1 + roles/ceph-osd/templates/ceph-osd.service.j2 | 1 + roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 | 1 + 5 files changed, 5 insertions(+) diff --git a/roles/ceph-crash/templates/ceph-crash.service.j2 b/roles/ceph-crash/templates/ceph-crash.service.j2 index 1a7b0f012..1424eda83 100644 --- a/roles/ceph-crash/templates/ceph-crash.service.j2 +++ b/roles/ceph-crash/templates/ceph-crash.service.j2 @@ -19,6 +19,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name ceph-crash-%i \ -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ +--security-opt label=disable \ --net=host \ {% if cluster != 'ceph' %} -e CEPH_ARGS="--cluster {{ cluster }}" \ diff --git a/roles/ceph-mds/templates/ceph-mds.service.j2 b/roles/ceph-mds/templates/ceph-mds.service.j2 index fc34cc48c..183dbf87e 100644 --- a/roles/ceph-mds/templates/ceph-mds.service.j2 +++ b/roles/ceph-mds/templates/ceph-mds.service.j2 @@ -25,6 +25,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ + --security-opt label=disable \ --memory={{ ceph_mds_docker_memory_limit }} \ --cpus={{ cpu_limit }} \ -v /var/lib/ceph/mds:/var/lib/ceph/mds:z \ diff --git a/roles/ceph-mgr/templates/ceph-mgr.service.j2 b/roles/ceph-mgr/templates/ceph-mgr.service.j2 index 3ba9a11d6..aee87a6ab 100644 --- a/roles/ceph-mgr/templates/ceph-mgr.service.j2 +++ b/roles/ceph-mgr/templates/ceph-mgr.service.j2 @@ -24,6 +24,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ + --security-opt label=disable \ --memory={{ ceph_mgr_docker_memory_limit }} \ --cpus={{ ceph_mgr_docker_cpu_limit }} \ -v /var/lib/ceph/mgr:/var/lib/ceph/mgr:z,rshared \ diff --git a/roles/ceph-osd/templates/ceph-osd.service.j2 b/roles/ceph-osd/templates/ceph-osd.service.j2 index e862669c5..c16fbf3de 100644 --- a/roles/ceph-osd/templates/ceph-osd.service.j2 +++ b/roles/ceph-osd/templates/ceph-osd.service.j2 @@ -30,6 +30,7 @@ numactl \ -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ + --security-opt label=disable \ --rm \ --net=host \ --privileged=true \ diff --git a/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 b/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 index 9a40cb4ac..79e4bf438 100644 --- a/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 +++ b/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 @@ -26,6 +26,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_mirror_docker_memory_limit }} \ --cpus={{ ceph_rbd_mirror_docker_cpu_limit }} \ + --security-opt label=disable \ -v /var/lib/ceph/bootstrap-rbd-mirror:/var/lib/ceph/bootstrap-rbd-mirror:Z \ -v /etc/ceph:/etc/ceph:z \ -v /var/run/ceph:/var/run/ceph:z \ -- 2.39.5