selinux vs. podman play kube volume

[bfallik]

Hi,

I'm trying to migrate an existing manual container deployment to podman play kube but I can't seem to setup the volume with correct selinux bits.

I have a USB disk that's mounted under /mnt. When using podman to create the container manually, I mounted the volume like so:

  ...  -v "/mnt/One Touch/backups/repo:/data/repo:Z" \

However, now that I'm using podman kube play, I can't figure out how to pass that 'Z'. I've tried this:

apiVersion: v1
kind: Pod
metadata:
  name: server
  annotations:
    bind-mount-options: "/mnt/One Touch/backups/repo:Z"

but the container just hangs in the Created state:

$ podman ps -a
CONTAINER ID  IMAGE                                    COMMAND               CREATED        STATUS        PORTS                   NAMES
f2e2ec9c5460  localhost/podman-pause:4.7.2-1698762721                        6 minutes ago  Up 6 minutes                          09d3badcb7f9-service
dd08057b1c77  localhost/podman-pause:4.7.2-1698762721                        6 minutes ago  Up 6 minutes  0.0.0.0:8000->8000/tcp  14d376a74a5d-infra
6d846bf325a3  docker.io/restic/rest-server:0.12.1      /entrypoint.sh        6 minutes ago  Created       0.0.0.0:8000->8000/tcp  rest-server-rest-server

Any idea what's going on here? Let me know if I can provide more details. Thx!

[rhatdan]

Can you change the mount for the usb stick to be labled correctly in the first place?

mount -o context="system_u:object_r:container_file_t:s0" ...

[rhatdan]

I wonder if the space in the name is screwing this up?

Also there is no documentation for this attribute in podman kube play man page.

[bfallik]

Can you change the mount for the usb stick to be labled correctly in the first place?

mount -o context="system_u:object_r:container_file_t:s0" ...

Doesn't seem to work from fstab.

UUID=8a2add9f-5798-4bf8-8116-98eece4b9333 /mnt/One\040Touch ext4 defaults,noatime,context=system_u:object_r:container_file_t:s0 0 0

sudo mount /mnt/One\ Touch/
mount: /mnt/One Touch: wrong fs type, bad option, bad superblock on /dev/sdb2, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.
mount: (hint) your fstab has been modified, but systemd still uses
       the old version; use 'systemctl daemon-reload' to reload.

Also there is no documentation for this attribute in podman kube play man page.

Right, I found a reference to it here. #16196 (comment)

[bfallik]

Also, meant to say "thank you for the response @rhatdan "

[rhatdan]

"system_u:object_r:container_file_t:s0" should work in fstab.

[bfallik]

@rhatdan Thanks. Was able to get the disk mounted with the SELinux context. Everything seems to working correctly if I remove the bind-mount-options annotation from the YAML.