[release/1.4 backport] selinux: relabel /dev/shm

Address an issue originally seen in the k3s 1.3 and 1.4 forks of
containerd/cri, k3s-io/k3s#2240.

This is a backport of containerd/containerd#4699

Even with updated container-selinux policy, container-local /dev/shm will get
mounted with container_runtime_tmpfs_t because it is a tmpfs created by the
runtime and not the container (thus, container_runtime_t transition rules apply).
The relabel mitigates such, allowing envoy proxy to work correctly (and other
programs that wish to write to their /dev/shm) under selinux.

Signed-off-by: Jacob Blain Christen <[email protected]>

Author: dweomer

pkg/server/container_create_unix.go

@@ -101,9 +101,10 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
 			sandboxDevShm = devShm
 		}
 		mounts = append(mounts, &runtime.Mount{
-			ContainerPath: devShm,
-			HostPath:      sandboxDevShm,
-			Readonly:      false,
+			ContainerPath:  devShm,
+			HostPath:       sandboxDevShm,
+			Readonly:       false,
+			SelinuxRelabel: sandboxDevShm != devShm,
 		})
 	}
 	return mounts

pkg/server/container_create_unix_test.go

@@ -457,9 +457,10 @@ func TestContainerMounts(t *testing.T) {
 					Readonly:      true,
 				},
 				{
-					ContainerPath: "/dev/shm",
-					HostPath:      filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
-					Readonly:      false,
+					ContainerPath:  "/dev/shm",
+					HostPath:       filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
+					Readonly:       false,
+					SelinuxRelabel: true,
 				},
 			},
 		},
@@ -482,9 +483,10 @@ func TestContainerMounts(t *testing.T) {
 					Readonly:      false,
 				},
 				{
-					ContainerPath: "/dev/shm",
-					HostPath:      filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
-					Readonly:      false,
+					ContainerPath:  "/dev/shm",
+					HostPath:       filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
+					Readonly:       false,
+					SelinuxRelabel: true,
 				},
 			},
 		},
@@ -555,9 +557,10 @@ func TestContainerMounts(t *testing.T) {
 					Readonly:      false,
 				},
 				{
-					ContainerPath: "/dev/shm",
-					HostPath:      filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
-					Readonly:      false,
+					ContainerPath:  "/dev/shm",
+					HostPath:       filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
+					Readonly:       false,
+					SelinuxRelabel: true,
 				},
 			},
 		},