Merge pull request #5234 from luomengY/compatible_selinux_install_edgecore

Resolve the issue of deploying edgecore failing when CR turns on selinux.

4 files changed, 34 insertions, 1 deletions

diff --git a/go.mod b/go.mod
index 591af8f8b..dbaa5164e 100644
--- a/go.mod
+++ b/go.mod
@@ -59,6 +59,7 @@ require (
 	github.com/avast/retry-go v3.0.0+incompatible
 	github.com/beego/beego v1.12.12
 	github.com/onsi/ginkgo/v2 v2.9.5
+	github.com/opencontainers/selinux v1.10.0
 	github.com/pkg/errors v0.9.1
 	go.opentelemetry.io/otel/trace v1.14.0
 	golang.org/x/text v0.13.0
@@ -196,7 +197,6 @@ require (
 	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
 	github.com/opencontainers/runc v1.1.6 // indirect
 	github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78 // indirect
-	github.com/opencontainers/selinux v1.10.0 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
diff --git a/keadm/cmd/keadm/app/cmd/edge/join_others.go b/keadm/cmd/keadm/app/cmd/edge/join_others.go
index 6fc674690..d5561c71c 100644
--- a/keadm/cmd/keadm/app/cmd/edge/join_others.go
+++ b/keadm/cmd/keadm/app/cmd/edge/join_others.go
@@ -27,6 +27,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/opencontainers/selinux/go-selinux"
 	"github.com/spf13/cobra"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/klog/v2"
@@ -220,6 +221,12 @@ func join(opt *common.JoinOptions, step *common.Step) error {
 }
 
 func runEdgeCore(withMqtt bool) error {
+	//If selinux is enabled, it is necessary to modify the context of edgecore, as edgecore is copied from the container
+	//and will be marked as container_file_t by selinux in container, the marked file cannot be operated by the host process.
+	err := selinuxLabelRevision(selinux.GetEnabled())
+	if err != nil {
+		return err
+	}
 	systemdExist := util.HasSystemd()
 
 	var binExec, tip string
@@ -250,3 +257,21 @@ func runEdgeCore(withMqtt bool) error {
 	klog.Infoln(tip)
 	return nil
 }
+
+func selinuxLabelRevision(enable bool) error {
+	if !enable {
+		return nil
+	}
+
+	label, err := selinux.FileLabel(filepath.Join(util.KubeEdgeUsrBinPath, util.KubeEdgeBinaryName))
+	if err != nil {
+		return fmt.Errorf("get selinux context of edgecore faild with error:%w", err)
+	}
+
+	if label != util.EdgeCoreSELinuxLabel {
+		if err = selinux.SetFileLabel(filepath.Join(util.KubeEdgeUsrBinPath, util.KubeEdgeBinaryName), util.EdgeCoreSELinuxLabel); err != nil {
+			return fmt.Errorf("reset selinux context on edgecore faild with error:%w", err)
+		}
+	}
+	return nil
+}
diff --git a/keadm/cmd/keadm/app/cmd/util/common.go b/keadm/cmd/keadm/app/cmd/util/common.go
index 39c3c841e..4cbc2c243 100644
--- a/keadm/cmd/keadm/app/cmd/util/common.go
+++ b/keadm/cmd/keadm/app/cmd/util/common.go
@@ -73,6 +73,8 @@ const (
 	APT    string = "apt"
 	YUM    string = "yum"
 	PACMAN string = "pacman"
+
+	EdgeCoreSELinuxLabel = "system_u:object_r:bin_t:s0"
 )
 
 // AddToolVals gets the value and default values of each flags and collects them in temporary cache
diff --git a/keadm/cmd/keadm/app/cmd/util/image.go b/keadm/cmd/keadm/app/cmd/util/image.go
index fea753bab..aa664d368 100644
--- a/keadm/cmd/keadm/app/cmd/util/image.go
+++ b/keadm/cmd/keadm/app/cmd/util/image.go
@@ -125,6 +125,7 @@ func (runtime *CRIRuntime) CopyResources(edgeImage string, files map[string]stri
 				NamespaceOptions: &runtimeapi.NamespaceOption{
 					Network: runtimeapi.NamespaceMode_NODE,
 				},
+				Privileged: true,
 			},
 		},
 	}
@@ -165,6 +166,11 @@ func (runtime *CRIRuntime) CopyResources(edgeImage string, files map[string]stri
 			"sleep infinity",
 		},
 		Mounts: mounts,
+		Linux: &runtimeapi.LinuxContainerConfig{
+			SecurityContext: &runtimeapi.LinuxContainerSecurityContext{
+				Privileged: true,
+			},
+		},
 	}
 	containerID, err := runtime.RuntimeService.CreateContainer(runtime.ctx, sandbox, containerConfig, psc)
 	if err != nil {