Automatically create and label /opt/cni and /etc/cni/net.d directories

[rdoxenham]

This commit automatically creates the /opt/cni and /etc/cni/net.d directories ahead of the RKE2 installer running. This ensures that the correct SELinux labels are applied as per rke2-selinux (https://github.com/rancher/rke2-selinux/blob/master/policy/slemicro/rke2.fc#L15-L16) for these directories, and ensures that CNIs such as Cilium can copy in the required binaries without SELinux AVC errors. The default behaviour of SELinux inherits the underlying /opt and /etc labels when sub-directories are created, thus not allowing the installation to complete successfully.

Fixes: #529

[atanasdinov]

Thanks! I guess we could accept this as a short term fix for this particular instance, but the underlying issue seems to be with either how policies are loaded or how the relabelling works.

[rdoxenham]

Thanks! I guess we could accept this as a short term fix for this particular instance, but the underlying issue seems to be with either how policies are loaded or how the relabelling works.

Actually, I think this is exactly how SELinux is supposed to work, check out #529 (comment)

[atanasdinov]

But all of this should already be covered by the postrpm script, no?

%define rke2_relabel_files()
umask 0022;
mkdir -p /etc/cni;
mkdir -p /opt/cni;
mkdir -p /var/lib/cni;
mkdir -p /var/lib/kubelet;
mkdir -p /var/lib/rancher/rke2/data;
mkdir -p /var/run/flannel;
umask 0027;
mkdir -p /var/lib/kubelet/pods;
mkdir -p /var/lib/rancher/rke2/agent;
umask 0066;
mkdir -p /var/run/k3s;
umask 0077;
mkdir -p /var/lib/rancher/rke2/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots;
mkdir -p /var/lib/rancher/rke2/server;
restorecon -R -i /etc/systemd/system/rke2*;
restorecon -R -i /usr/lib/systemd/system/rke2*;
restorecon -R /var/lib/cni;
restorecon -R /opt/cni;
restorecon -R /etc/cni;
restorecon -R /var/lib/kubelet;
restorecon -R /var/lib/rancher;
restorecon -R /var/run/k3s;
restorecon -R /var/run/flannel

[rdoxenham]

But all of this should already be covered by the postrpm script, no?

%define rke2_relabel_files()
umask 0022;
mkdir -p /etc/cni;
mkdir -p /opt/cni;
(snip)
restorecon -R /opt/cni;
restorecon -R /etc/cni;
(snip)

That's a very good point. However, these directories aren't even created on the base image:

% podman run -it 7912e1c51432083b593562e6dcb19a32e27d785002d696a6f11e246eb2779f60 bash
0651ad6ef2af:/ # rpm -qa rke2-selinux
rke2-selinux-0.22.stable.1-160000.2.24.noarch
0651ad6ef2af:/ # ls -la /etc/cni
ls: cannot access '/etc/cni': No such file or directory
0651ad6ef2af:/ # ls -la /opt/cni
ls: cannot access '/opt/cni': No such file or directory

It looks like this only ever gets executed if SELinux is enabled in the build host:

%post
semodule -n -i %{_datadir}/selinux/packages/rke2.pp
if /usr/sbin/selinuxenabled ; then
    if [ -z "${TRANSACTIONAL_UPDATE}" ]; then
        /usr/sbin/load_policy
    fi
    %rke2_relabel_files
fi;

And recent changes in rke2-selinux (rancher/rke2-selinux@7a0b8ee) only do this if TRANSACTIONAL_UPDATE is set. Need to check our internal build system.

[dirkmueller]

I think this script should be fixed to use systemd-tmpfiles instead to generate this..

I'll take a look