USHIFT-7240: work around kernel 7.x SELinux execmem denial on EL10 bootc#6874
USHIFT-7240: work around kernel 7.x SELinux execmem denial on EL10 bootc#6874eslutsky wants to merge 1 commit into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
Walkthrough
ChangesSELinux Policy Workaround
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Suggested labels
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
/retest |
|
/test |
|
/retest |
1 similar comment
|
/retest |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: eslutsky, ggiguash The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
eslutsky
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@eslutsky: This pull request references USHIFT-7240 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest |
Add allow rule to the microshift SELinux policy module so that CRI-O can perform text relocations when running as kernel_t on composefs. This is needed until the RHEL 10.2 kernel backports the upstream fix (880bd496ec72, 6af36aeb147a, 82544d36b172). USHIFT-7215 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
eslutsky
force-pushed
the
BUG-USHIFT-7215
branch
from
b1d80ad to
1b65a77
Compare
|
New changes are detected. LGTM label has been removed. |
coderabbitai
Bot
added
the
ready-for-human-review
|
/test ci/prow/test-unit |
|
/test pull-ci-openshift-microshift-main-test-unit |
|
/test test-unit |
|
@eslutsky: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/test ci/prow/e2e-aws-tests-bootc-el9 |
|
@eslutsky: The specified target(s) for The following commands are available to trigger optional jobs: Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test ci/prow/e2e-aws-tests-bootc-el9 |
|
@eslutsky: The specified target(s) for The following commands are available to trigger optional jobs: Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/close |
|
@eslutsky: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
Summary
mprotect()checks on composefs/overlayfs evaluate the backing file's context instead of the overlay file's contextkernel_tinstead ofcontainer_runtime_t, which denies theexecmempermission needed for text relocations (CGO libgpgme binding)rhel102-test-agent), unblocking all EL10 bootc CI jobsRoot cause
Kernel 7.0 has a regression in LSM/overlayfs where
mprotect()access checks evaluate the backing file's security context instead of the overlay file's context. On composefs (used by bootc), this prevents SELinux domain transitions — CRI-O stays askernel_tinstead of transitioning tocontainer_runtime_t.Upstream fix
3-commit series by Paul Moore, landed in v7.1-rc1 (not yet backported to RHEL 10.2 kernel):
880bd496ec72— fs: prepare for adding LSM blob to backing_file6af36aeb147a— lsm: add backing_file LSM hooks82544d36b172— selinux: fix overlayfs mmap() and mprotect() access checksWhat this PR does
Adds to the EL10 base containerfile (
rhel102-test-agent.containerfile):execmemtokernel_tcrio.serviceSince all EL10 bootc images inherit from
rhel102-test-agent, this covers every affected job.Remove this workaround once the upstream kernel fix is backported to the RHEL 10.2 kernel.
References
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes