<p>I am trying to mount a <a href="https://kubernetes.io/docs/concepts/storage/volumes/#hostpath" rel="nofollow noreferrer">hostPath volume</a> into a Kubernetes Pod.  An example of a <code>hostPath</code> volume specification is shown below, which is taken from the docs.  I am deploying to hosts that are running RHEL 7 with SELinux enabled.</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /test-pd
      name: test-volume
  volumes:
  - name: test-volume
    hostPath:
      # directory location on host
      path: /data
      # this field is optional
      type: Directory
</code></pre>

<p>When my Pod tries to read from a file that has been mounted from the underlying host, I get a "Permission Denied" error.  When I run <code>setenforce 0</code> to turn off SELinux, the error goes away and I can access the file.  I get the same error when I bind mount a directory into a Docker container.</p>

<p>The issue is described <a href="https://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/" rel="nofollow noreferrer">here</a> and, when using Docker, can be fixed by using the <code>z</code> or <code>Z</code> bind mount flag, described in the Docker docs <a href="https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label" rel="nofollow noreferrer">here</a>.</p>

<p>Whilst I can fix the issue by running</p>

<pre><code>chcon -Rt svirt_sandbox_file_t /path/to/my/host/dir/to/mount
</code></pre>

<p>I see this as a nasty hack, as I need to do this on every host in my Kubernetes cluster and also because my deployment of Kubernetes as described in the YAML spec is not a complete description of what it is that needs to be done to get my YAML to run correctly.  Turning off SELinux is not an option.</p>

<p>I can see that Kubernetes mentions SELinux security contexts in the docs <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">here</a>, but I haven't been able to successfully mount a hostPath volume into a pod without getting the permission denied error.</p>

<p>What does the YAML need to look like to successfully enable a container to mount a HostPath volume from an underlying host that is running SELinux?</p>

<p><strong>Update:</strong></p>

<p>The file I am accessing is a CA certificate that has these labels:</p>

<pre><code>system_u:object_r:cert_t:s0
</code></pre>

<p>When I use the following options:</p>

<pre><code>securityContext:
  seLinuxOptions:
    level: "s0:c123,c456"
</code></pre>

<p>and then check the access control audit errors via <code>ausearch -m avc -ts recent</code>, I can see that there is a permission denied error where the container has a level label of <code>s0:c123,c456</code>, so I can see that the level label works.  I have set the label to be <code>s0</code>.</p>

<p>However, if I try to change the <code>type</code> label to be <code>cert_t</code>, the container doesn't even start, there's an error :</p>

<pre><code>container_linux.go:247: starting container process caused "process_linux.go:364: container init caused \"write /proc/self/task/1/attr/exec: invalid argument\""
</code></pre>

<p>I don't seem to be able to change the type label of the container.</p>

John
<p>You can assign SELinux labels using <code>seLinuxOptions</code>:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /test-pd
      name: test-volume
    securityContext:
      seLinuxOptions: # it may don’t have the desired effect
        level: &quot;s0:c123,c456&quot;
  securityContext:
    seLinuxOptions:
      level: &quot;s0:c123,c456&quot;
  volumes:
  - name: test-volume
    hostPath:
      # directory location on host
      path: /data
      # this field is optional
      type: Directory
</code></pre>
<p>According to <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">documentation</a>:</p>
<p>Thanks to <a href="https://stackoverflow.com/users/1020315/phil">Phil</a> for pointing that out. It appears to be working only in <code>Pod.spec.securityContext</code> according to the <a href="https://github.com/projectatomic/adb-atomic-developer-bundle/issues/117#issuecomment-215313573" rel="nofollow noreferrer">issue comment</a></p>
<ul>
<li><strong>seLinuxOptions</strong>: Volumes that support SELinux labeling are relabeled to be accessible by the label specified under seLinuxOptions. Usually you only need to set the level section. This sets the Multi-Category Security (MCS) label <strong>given to all Containers in the Pod as well as the Volumes</strong>.</li>
</ul>
