[OCPBUGS#48588]: SCC and PSA steps for applying SELinux profiles

[DeokarT]

Version(s):
4.17 and later (reproduced on 4.19 / SPO 0.10.0). Please cherry-pick to enterprise-4.17+ if this looks ok.

Issue:
https://issues.redhat.com/browse/OCPBUGS-48588

Additional information:

Followed the applying-profiles section on 4.19 with SPO v0.10.0. SelinuxProfile is cluster-scoped (NAMESPACED=false).

Profile

$ oc apply -f selinuxprofile.yaml
selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure created

$ oc get selinuxprofile nginx-secure
NAME           USAGE                  STATE
nginx-secure   nginx-secure.process   InProgress

$ oc wait --for=condition=ready selinuxprofile nginx-secure --timeout=180s
selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure condition met

$ oc get selinuxprofile nginx-secure -o jsonpath='status={.status.status} usage={.status.usage}{"\n"}'
status=Installed usage=nginx-secure.process

Docs steps (PSA enforce only), as cluster-admin

$ oc label ns nginx-deploy security.openshift.io/scc.podSecurityLabelSync=false --overwrite
namespace/nginx-deploy labeled

$ oc label ns nginx-deploy pod-security.kubernetes.io/enforce=privileged --overwrite
namespace/nginx-deploy labeled

$ oc get ns nginx-deploy --show-labels
NAME           STATUS   AGE   LABELS
nginx-deploy   Active   11m   kubernetes.io/metadata.name=nginx-deploy,pod-security.kubernetes.io/audit-version=latest,pod-security.kubernetes.io/audit=restricted,pod-security.kubernetes.io/enforce=privileged,pod-security.kubernetes.io/warn-version=latest,pod-security.kubernetes.io/warn=restricted,security.openshift.io/scc.podSecurityLabelSync=false

warn/audit stay restricted. Pod still creates, with a warning:

$ oc apply -f nginx-secure-pod.yaml
Warning: would violate PodSecurity "restricted:latest": seLinuxOptions (container "nginx" set forbidden securityContext.seLinuxOptions: type "nginx-secure.process")
pod/nginx-secure created

$ oc get pod nginx-secure -n nginx-deploy
NAME           READY   STATUS    RESTARTS   AGE
nginx-secure   1/1     Running   0          17s

$ oc get pod nginx-secure -n nginx-deploy -o jsonpath='scc={.metadata.annotations.openshift\.io/scc}{"\n"}seLinuxOptions={.spec.containers[0].securityContext.seLinuxOptions}{"\n"}'
scc=insights-runtime-extractor-scc
seLinuxOptions={"type":"nginx-secure.process"}

$ oc exec -n nginx-deploy nginx-secure -- cat /proc/self/attr/current
system_u:system_r:nginx-secure.process:s0:c160,c578

So as cluster-admin the type does apply. Admission used insights-runtime-extractor-scc, not something the docs mention.

Same pod as a normal user (SA docs-test, edit only)

$ oc create sa docs-test -n nginx-deploy
serviceaccount/docs-test created

$ oc adm policy add-role-to-user edit -z docs-test -n nginx-deploy
clusterrole.rbac.authorization.k8s.io/edit added: "docs-test"

$ oc apply --as=system:serviceaccount:nginx-deploy:docs-test -n nginx-deploy -f nginx-secure-pod.yaml
Error from server (Forbidden): error when creating "STDIN": pods "nginx-secure" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .containers[0].seLinuxOptions.level: Invalid value: "": must be s0:c27,c14, provider restricted-v2: .containers[0].seLinuxOptions.type: Invalid value: "nginx-secure.process": must be , provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid-v2": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "insights-runtime-extractor-scc": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]

restricted-v2 will not allow seLinuxOptions.type: nginx-secure.process. The apply-to-pod procedure never grants an SCC with seLinuxContext: RunAsAny.

This PR adds the SA / SCC use steps, sets warn/audit to privileged, puts serviceAccountName on the example pod, adds a check of /proc/self/attr/current, and notes that SelinuxProfile is cluster-scoped.

Trushna Deokar

[openshift-ci]

Hi @DeokarT. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.