Support volume relabling for pods which specify an SELinux label

test/e2e/security_context.go

@@ -29,9 +29,10 @@ import (
 	"k8s.io/kubernetes/pkg/util"
 
 	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
 )
 
-func scTestPod() *api.Pod {
+func scTestPod(hostIPC bool, hostPID bool) *api.Pod {
 	podName := "security-context-" + string(util.NewUUID())
 	pod := &api.Pod{
 		ObjectMeta: api.ObjectMeta{
@@ -39,7 +40,10 @@ func scTestPod() *api.Pod {
 			Labels: map[string]string{"name": podName},
 		},
 		Spec: api.PodSpec{
-			SecurityContext: &api.PodSecurityContext{},
+			SecurityContext: &api.PodSecurityContext{
+				HostIPC: hostIPC,
+				HostPID: hostPID,
+			},
 			Containers: []api.Container{
 				{
 					Name:  "test-container",
@@ -57,7 +61,7 @@ var _ = Describe("[Skipped] Security Context", func() {
 	framework := NewFramework("security-context")
 
 	It("should support pod.Spec.SecurityContext.SupplementalGroups", func() {
-		pod := scTestPod()
+		pod := scTestPod(false, false)
 		pod.Spec.Containers[0].Command = []string{"id", "-G"}
 		pod.Spec.SecurityContext.SupplementalGroups = []int64{1234, 5678}
 		groups := []string{"1234", "5678"}
@@ -65,7 +69,7 @@ var _ = Describe("[Skipped] Security Context", func() {
 	})
 
 	It("should support pod.Spec.SecurityContext.RunAsUser", func() {
-		pod := scTestPod()
+		pod := scTestPod(false, false)
 		var uid int64 = 1001
 		pod.Spec.SecurityContext.RunAsUser = &uid
 		pod.Spec.Containers[0].Command = []string{"sh", "-c", "id -u"}
@@ -76,7 +80,7 @@ var _ = Describe("[Skipped] Security Context", func() {
 	})
 
 	It("should support container.SecurityContext.RunAsUser", func() {
-		pod := scTestPod()
+		pod := scTestPod(false, false)
 		var uid int64 = 1001
 		var overrideUid int64 = 1002
 		pod.Spec.SecurityContext.RunAsUser = &uid
@@ -88,4 +92,112 @@ var _ = Describe("[Skipped] Security Context", func() {
 			fmt.Sprintf("%v", overrideUid),
 		})
 	})
+
+	It("should support volume SELinux relabeling", func() {
+		testPodSELinuxLabeling(framework, false, false)
+	})
+
+	It("should support volume SELinux relabeling when using hostIPC", func() {
+		testPodSELinuxLabeling(framework, true, false)
+	})
+
+	It("should support volume SELinux relabeling when using hostPID", func() {
+		testPodSELinuxLabeling(framework, false, true)
+	})
+
 })
+
+func testPodSELinuxLabeling(framework *Framework, hostIPC bool, hostPID bool) {
+	// Write and read a file with an empty_dir volume
+	// with a pod with the MCS label s0:c0,c1
+	pod := scTestPod(hostIPC, hostPID)
+	volumeName := "test-volume"
+	mountPath := "/mounted_volume"
+	pod.Spec.Containers[0].VolumeMounts = []api.VolumeMount{
+		{
+			Name:      volumeName,
+			MountPath: mountPath,
+		},
+	}
+	pod.Spec.Volumes = []api.Volume{
+		{
+			Name: volumeName,
+			VolumeSource: api.VolumeSource{
+				EmptyDir: &api.EmptyDirVolumeSource{
+					Medium: api.StorageMediumDefault,
+				},
+			},
+		},
+	}
+	pod.Spec.SecurityContext.SELinuxOptions = &api.SELinuxOptions{
+		Level: "s0:c0,c1",
+	}
+	pod.Spec.Containers[0].Command = []string{"sleep", "6000"}
+
+	client := framework.Client.Pods(framework.Namespace.Name)
+	_, err := client.Create(pod)
+
+	expectNoError(err, "Error creating pod %v", pod)
+	defer client.Delete(pod.Name, nil)
+	expectNoError(waitForPodRunningInNamespace(framework.Client, pod.Name, framework.Namespace.Name))
+
+	testContent := "hello"
+	testFilePath := mountPath + "/TEST"
+	err = framework.WriteFileViaContainer(pod.Name, pod.Spec.Containers[0].Name, testFilePath, testContent)
+	Expect(err).To(BeNil())
+	content, err := framework.ReadFileViaContainer(pod.Name, pod.Spec.Containers[0].Name, testFilePath)
+	Expect(err).To(BeNil())
+	Expect(content).To(ContainSubstring(testContent))
+
+	foundPod, err := framework.Client.Pods(framework.Namespace.Name).Get(pod.Name)
+	Expect(err).NotTo(HaveOccurred())
+
+	// Confirm that the file can be accessed from a second
+	// pod using host_path with the same MCS label
+	volumeHostPath := fmt.Sprintf("/var/lib/kubelet/pods/%s/volumes/kubernetes.io~empty-dir/%s", foundPod.UID, volumeName)
+	By("confirming a container with the same label can read the file")
+	pod = scTestPod(hostIPC, hostPID)
+	pod.Spec.NodeName = foundPod.Spec.NodeName
+	volumeMounts := []api.VolumeMount{
+		{
+			Name:      volumeName,
+			MountPath: mountPath,
+		},
+	}
+	volumes := []api.Volume{
+		{
+			Name: volumeName,
+			VolumeSource: api.VolumeSource{
+				HostPath: &api.HostPathVolumeSource{
+					Path: volumeHostPath,
+				},
+			},
+		},
+	}
+	pod.Spec.Containers[0].VolumeMounts = volumeMounts
+	pod.Spec.Volumes = volumes
+	pod.Spec.Containers[0].Command = []string{"cat", testFilePath}
+	pod.Spec.SecurityContext.SELinuxOptions = &api.SELinuxOptions{
+		Level: "s0:c0,c1",
+	}
+
+	framework.TestContainerOutput("Pod with same MCS label reading test file", pod, 0, []string{testContent})
+	// Confirm that the same pod with a different MCS
+	// label cannot access the volume
+	pod = scTestPod(hostIPC, hostPID)
+	pod.Spec.Volumes = volumes
+	pod.Spec.Containers[0].VolumeMounts = volumeMounts
+	pod.Spec.Containers[0].Command = []string{"sleep", "6000"}
+	pod.Spec.SecurityContext.SELinuxOptions = &api.SELinuxOptions{
+		Level: "s0:c2,c3",
+	}
+	_, err = client.Create(pod)
+	expectNoError(err, "Error creating pod %v", pod)
+	defer client.Delete(pod.Name, nil)
+
+	err = framework.WaitForPodRunning(pod.Name)
+	expectNoError(err, "Error waiting for pod to run %v", pod)
+
+	content, err = framework.ReadFileViaContainer(pod.Name, "test-container", testFilePath)
+	Expect(content).NotTo(ContainSubstring(testContent))
+}