Merge pull request #5234 from luomengY/compatible_selinux_install_edgecore

Resolve the issue of deploying edgecore failing when CR turns on selinux.

3 files changed, 33 insertions, 0 deletions

diff --git a/keadm/cmd/keadm/app/cmd/edge/join_others.go b/keadm/cmd/keadm/app/cmd/edge/join_others.go
index 6fc674690..d5561c71c 100644
--- a/keadm/cmd/keadm/app/cmd/edge/join_others.go
+++ b/keadm/cmd/keadm/app/cmd/edge/join_others.go
@@ -27,6 +27,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/opencontainers/selinux/go-selinux"
 	"github.com/spf13/cobra"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/klog/v2"
@@ -220,6 +221,12 @@ func join(opt *common.JoinOptions, step *common.Step) error {
 }
 
 func runEdgeCore(withMqtt bool) error {
+	//If selinux is enabled, it is necessary to modify the context of edgecore, as edgecore is copied from the container
+	//and will be marked as container_file_t by selinux in container, the marked file cannot be operated by the host process.
+	err := selinuxLabelRevision(selinux.GetEnabled())
+	if err != nil {
+		return err
+	}
 	systemdExist := util.HasSystemd()
 
 	var binExec, tip string
@@ -250,3 +257,21 @@ func runEdgeCore(withMqtt bool) error {
 	klog.Infoln(tip)
 	return nil
 }
+
+func selinuxLabelRevision(enable bool) error {
+	if !enable {
+		return nil
+	}
+
+	label, err := selinux.FileLabel(filepath.Join(util.KubeEdgeUsrBinPath, util.KubeEdgeBinaryName))
+	if err != nil {
+		return fmt.Errorf("get selinux context of edgecore faild with error:%w", err)
+	}
+
+	if label != util.EdgeCoreSELinuxLabel {
+		if err = selinux.SetFileLabel(filepath.Join(util.KubeEdgeUsrBinPath, util.KubeEdgeBinaryName), util.EdgeCoreSELinuxLabel); err != nil {
+			return fmt.Errorf("reset selinux context on edgecore faild with error:%w", err)
+		}
+	}
+	return nil
+}
diff --git a/keadm/cmd/keadm/app/cmd/util/common.go b/keadm/cmd/keadm/app/cmd/util/common.go
index 39c3c841e..4cbc2c243 100644
--- a/keadm/cmd/keadm/app/cmd/util/common.go
+++ b/keadm/cmd/keadm/app/cmd/util/common.go
@@ -73,6 +73,8 @@ const (
 	APT    string = "apt"
 	YUM    string = "yum"
 	PACMAN string = "pacman"
+
+	EdgeCoreSELinuxLabel = "system_u:object_r:bin_t:s0"
 )
 
 // AddToolVals gets the value and default values of each flags and collects them in temporary cache
diff --git a/keadm/cmd/keadm/app/cmd/util/image.go b/keadm/cmd/keadm/app/cmd/util/image.go
index fea753bab..aa664d368 100644
--- a/keadm/cmd/keadm/app/cmd/util/image.go
+++ b/keadm/cmd/keadm/app/cmd/util/image.go
@@ -125,6 +125,7 @@ func (runtime *CRIRuntime) CopyResources(edgeImage string, files map[string]stri
 				NamespaceOptions: &runtimeapi.NamespaceOption{
 					Network: runtimeapi.NamespaceMode_NODE,
 				},
+				Privileged: true,
 			},
 		},
 	}
@@ -165,6 +166,11 @@ func (runtime *CRIRuntime) CopyResources(edgeImage string, files map[string]stri
 			"sleep infinity",
 		},
 		Mounts: mounts,
+		Linux: &runtimeapi.LinuxContainerConfig{
+			SecurityContext: &runtimeapi.LinuxContainerSecurityContext{
+				Privileged: true,
+			},
+		},
 	}
 	containerID, err := runtime.RuntimeService.CreateContainer(runtime.ctx, sandbox, containerConfig, psc)
 	if err != nil {