<p>I am trying to mount a <a href="https://kubernetes.io/docs/concepts/storage/volumes/#hostpath" rel="nofollow noreferrer">hostPath volume</a> into a Kubernetes Pod.  An example of a <code>hostPath</code> volume specification is shown below, which is taken from the docs.  I am deploying to hosts that are running RHEL 7 with SELinux enabled.</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /test-pd
      name: test-volume
  volumes:
  - name: test-volume
    hostPath:
      # directory location on host
      path: /data
      # this field is optional
      type: Directory
</code></pre>

<p>When my Pod tries to read from a file that has been mounted from the underlying host, I get a "Permission Denied" error.  When I run <code>setenforce 0</code> to turn off SELinux, the error goes away and I can access the file.  I get the same error when I bind mount a directory into a Docker container.</p>

<p>The issue is described <a href="https://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/" rel="nofollow noreferrer">here</a> and, when using Docker, can be fixed by using the <code>z</code> or <code>Z</code> bind mount flag, described in the Docker docs <a href="https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label" rel="nofollow noreferrer">here</a>.</p>

<p>Whilst I can fix the issue by running</p>

<pre><code>chcon -Rt svirt_sandbox_file_t /path/to/my/host/dir/to/mount
</code></pre>

<p>I see this as a nasty hack, as I need to do this on every host in my Kubernetes cluster and also because my deployment of Kubernetes as described in the YAML spec is not a complete description of what it is that needs to be done to get my YAML to run correctly.  Turning off SELinux is not an option.</p>

<p>I can see that Kubernetes mentions SELinux security contexts in the docs <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">here</a>, but I haven't been able to successfully mount a hostPath volume into a pod without getting the permission denied error.</p>

<p>What does the YAML need to look like to successfully enable a container to mount a HostPath volume from an underlying host that is running SELinux?</p>

<p><strong>Update:</strong></p>

<p>The file I am accessing is a CA certificate that has these labels:</p>

<pre><code>system_u:object_r:cert_t:s0
</code></pre>

<p>When I use the following options:</p>

<pre><code>securityContext:
  seLinuxOptions:
    level: "s0:c123,c456"
</code></pre>

<p>and then check the access control audit errors via <code>ausearch -m avc -ts recent</code>, I can see that there is a permission denied error where the container has a level label of <code>s0:c123,c456</code>, so I can see that the level label works.  I have set the label to be <code>s0</code>.</p>

<p>However, if I try to change the <code>type</code> label to be <code>cert_t</code>, the container doesn't even start, there's an error :</p>

<pre><code>container_linux.go:247: starting container process caused "process_linux.go:364: container init caused \"write /proc/self/task/1/attr/exec: invalid argument\""
</code></pre>

<p>I don't seem to be able to change the type label of the container.</p>

<p>Expanding on <a href="https://stackoverflow.com/a/51026623/1020315">the answer from VAS</a> as it is partially correct:</p>
<p><strong>You can only specify the level portion of an SELinux label</strong> when relabeling a path destination pointed to by a <code>hostPath</code> volume. This is automatically done so by the <code>seLinuxOptions.level</code> attribute specified in your <code>securityContext</code>.</p>
<p>However attributes such as <code>seLinuxOptions.type</code> currently have no effect on volume relabeling. As of this writing, this is still an <a href="https://github.com/projectatomic/adb-atomic-developer-bundle/issues/117" rel="nofollow noreferrer">open issue within Kubernetes</a></p>
