<p>I have created a pod on Kubernetes and mounted a local volume but when I try to execute the ls command on locally mounted volume, I get a permission denied error. If I disable SELINUX then everything works fine. I am unable to make out how do I make it work with SELinux enabled.</p>
<h3>Following is the output of permission denied:</h3>
<pre><code>kubectl apply -f testpod.yaml
root@olcne-operator-ol8 opc]# kubectl get all
NAME            READY   STATUS    RESTARTS   AGE
pod/testpod     1/1     Running   0          5s
# kubectl exec -i -t testpod /bin/bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@testpod /]# cd /u01
[root@testpod u01]# ls
ls: cannot open directory '.': Permission denied
[root@testpod u01]#
</code></pre>
<h3>Following is the testpod.yaml</h3>
<pre><code>cat testpod.yaml
kind: Pod
apiVersion: v1
metadata:
  name: testpod
  labels:
    name: testpod
spec:
  hostname: testpod
  restartPolicy: Never
  volumes:
    - name: swvol
      hostPath:
        path: /u01
  containers:
    - name: testpod
      image: oraclelinux:8
      imagePullPolicy: Always
      securityContext:
       privileged: false
      command: [/usr/sbin/init]
      volumeMounts:
      - mountPath: &quot;/u01&quot;
        name: swvol
</code></pre>
<h3>Selinux Configuration on worker node:</h3>
<pre><code># sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31

---
# semanage fcontext -l  | grep kub | grep container_file
/var/lib/kubelet/pods(/.*)?                        all files          system_u:object_r:container_file_t:s0
/var/lib/kubernetes/pods(/.*)?                     all files          system_u:object_r:container_file_t:s0
</code></pre>
<h3>Machine OS Details</h3>
<pre><code> rpm -qa | grep kube
kubectl-1.20.6-2.el8.x86_64
kubernetes-cni-0.8.1-1.el8.x86_64
kubeadm-1.20.6-2.el8.x86_64
kubelet-1.20.6-2.el8.x86_64
kubernetes-cni-plugins-0.9.1-1.el8.x86_64

----
cat /etc/oracle-release
Oracle Linux Server release 8.4

---
uname -r
5.4.17-2102.203.6.el8uek.x86_64

</code></pre>

drifter
<p><em>This is a community wiki answer posted for better visibility. Feel free to expand it.</em></p>
<p>SELinux labels can be assigned with <code>seLinuxOptions</code>:</p>
<pre><code>apiVersion: v1
metadata:
  name: testpod
  labels:
    name: testpod
spec:
  hostname: testpod
  restartPolicy: Never
  volumes:
    - name: swvol
      hostPath:
        path: /u01
  containers:
    - name: testpod
      image: oraclelinux:8
      imagePullPolicy: Always
      command: [/usr/sbin/init]
      volumeMounts:
      - mountPath: &quot;/u01&quot;
        name: swvol
  securityContext:
    seLinuxOptions:
      level: &quot;s0:c123,c456&quot;
</code></pre>
<p>From the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#discussion" rel="nofollow noreferrer">official documentation</a>:</p>
<blockquote>
<p><code>seLinuxOptions</code>: Volumes that support SELinux labeling are relabeled
to be accessible by the label specified under <code>seLinuxOptions</code>.
Usually you only need to set the <code>level</code> section. This sets the
Multi-Category Security (MCS) label given to all Containers in the Pod
as well as the Volumes.</p>
</blockquote>
<p>Based on the information from the <a href="https://stackoverflow.com/questions/51000791/how-to-mount-hostpath-volume-in-kubernetes-with-selinux">original post on stackoverflow</a>:</p>
<blockquote>
<p><strong>You can only specify the level portion of an SELinux label</strong> when relabeling a path destination pointed to by a <code>hostPath</code> volume. This
is automatically done so by the <code>seLinuxOptions.level</code> attribute
specified in your <code>securityContext</code>.</p>
<p>However attributes such as <code>seLinuxOptions.type</code> currently have no
effect on volume relabeling. As of this writing, this is still an
<a href="https://github.com/projectatomic/adb-atomic-developer-bundle/issues/117" rel="nofollow noreferrer">open issue within
Kubernetes</a></p>
</blockquote>
