Mounting volume with multiple SELinux MCS categories (mount -o <context>)

[rajivr]

I am trying to manually mount an ext4 volume from sheltie.

For some reason, the mount command fails when I specify multiple MCS categories (for example c100,c110). But it seems to work, when one category is specified (for example c100) or when I specify a category range (for example c100.c105).

You can reproduce the behavior with bottlerocket-aws-k8s-1.35-x86_64-v1.55.0-d93bb1b1 (AMI ID: ami-008cbe8c3017948d3 in us-east-2) with kubelet in standalone mode.

bash-5.2# cd /mnt/
bash-5.2# mkdir /mnt/app-pomerium
bash-5.2# ls -Z
system_u:object_r:local_t:s0 app-pomerium

bash-5.2# ls -l /dev/disk/by-label/
total 0
lrwxrwxrwx. 1 root root 15 Mar  2 10:49 BOTTLEROCKET -> ../../nvme1n1p1
lrwxrwxrwx. 1 root root 15 Mar  2 10:49 app-pomerium -> ../../nvme2n1p1

Now, if I try to mount volume /dev/disk/by-label/app-pomerium with a context system_u:object_r:data_t:s0:c100,c110, I would get an error.

bash-5.2# mount -o rw,context="system_u:object_r:data_t:s0:c100,c110",data=ordered /dev/disk/by-label/app-pomerium /mnt/app-pomerium
mount: /mnt/app-pomerium: wrong fs type, bad option, bad superblock on /dev/nvme2n1p1, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.

From dmesg, I see the following error.

[   20.152570]  nvme2n1: p1
[ 2262.691797] ext4: Unknown parameter 'c110'

I cannot seem to find any audit errors.

bash-5.2# journalctl -b --no-pager --no-hostname | grep audit
Mar 02 10:49:19 kernel: audit: initializing netlink subsys (disabled)
Mar 02 10:49:19 kernel: audit: type=2000 audit(1772448559.625:1): state=initialized audit_enabled=0 res=1
Mar 02 10:49:19 kernel: audit: type=1403 audit(1772448558.860:2): auid=4294967295 ses=4294967295 lsm=selinux res=1
Mar 02 10:49:19 systemd[1]: Starting Load audit rules...
Mar 02 10:49:19 systemd[1]: Finished Load audit rules.
Mar 02 10:49:19 systemd-journald[673]: Collecting audit messages is enabled.
Mar 02 10:49:19 auditctl[649]: No rules

If I were to use a context with only one MCS category (system_u:object_r:data_t:s0:c100), the mount command works.

bash-5.2# mount -o rw,context="system_u:object_r:data_t:s0:c100",data=ordered /dev/disk/by-label/app-pomerium /mnt/app-pomerium

bash-5.2# ls -Z
? app-pomerium
bash-5.2# ls -Z /mnt/app-pomerium/
system_u:object_r:data_t:s0:c100 lego-path                                 
?                                lost+found

bash-5.2# umount /mnt/app-pomerium/

bash-5.2# ls -Z /mnt/
system_u:object_r:local_t:s0 app-pomerium

If I were to use a context with MCS range (system_u:object_r:data_t:s0:c100.c105), the same mount command works.

bash-5.2# mount -o rw,context="system_u:object_r:data_t:s0:c100.c105",data=ordered /dev/disk/by-label/app-pomerium /mnt/app-pomerium

bash-5.2# ls -Z
? app-pomerium
bash-5.2# ls -Z /mnt/app-pomerium/
system_u:object_r:data_t:s0:c100.c105 lego-path
                                    ? lost+found

bash-5.2# umount /mnt/app-pomerium/

bash-5.2# ls -Z
system_u:object_r:local_t:s0 app-pomerium

I looked at this PR and other previous discussions. In essence what I am trying to do, is to manually replicate the behavior of a CSI driver in a non Kubernetes scenario.

I even looked to see if there was a potential mismatch between the mount command used by Bottlerocket and AWS EBS CSI driver.

bash-5.2# mount --version
mount from util-linux 2.41.3 (libmount 2.41.3: selinux, btrfs, namespaces, statx, assert, debug)

It looks like AWS EBS CSI driver is using older version of util-linux.

$ docker run --rm --entrypoint /bin/mount public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.56.0 --version
mount from util-linux 2.37.4 (libmount 2.37.4: selinux, btrfs, namespaces, assert, debug)

Any pointers on how I might be able to resolve this would be really appreciated! 🙏

[bcressey]

@rajivr - needs some additional quoting to avoid splitting the option on a comma:

bash-5.2# mount -t tmpfs none -ocontext="system_u:object_r:local_t:s0:c1,c3" /tmp/foo
mount: /tmp/foo: fsconfig() failed: tmpfs: Unknown parameter 'c3'.
       dmesg(1) may have more information after failed mount system call.

bash-5.2# mount -t tmpfs none -o'context="system_u:object_r:local_t:s0:c1,c3"' /tmp/foo
<succeeds>

[rajivr]

Thanks for the reply @bcressey . Additional quoting works!