KubeVirt does not work with Talos Linux 1.9

[kvaps]

Bug Report

Description

Logs

virt-handler reports an error during VM creation:

failed to configure vmi network: setup failed, err: Critical network error: could not retrieve pid 199735 selinux label: getxattr /proc/199735/attr/current: operation not supported

this is happening because of selinux enabled:

cat /sys/fs/selinux/enforce
0

code:

• https://github.com/kubevirt/kubevirt/blob/9120e62feedcb842be595a9d1069e305c07d01b9/pkg/virt-handler/selinux/context_executor.go#L112
• https://github.com/kubevirt/kubevirt/blob/9120e62feedcb842be595a9d1069e305c07d01b9/cmd/virt-chroot/selinux.go#L102

Environment

• Talos version: v1.9.1
• Kubernetes version: v1.30.3
• Platform: Cozystack

I tried to disable selinux using machineconfig:

machine:
    install:
        extraKernelArgs:
        - -selinux

and

machine:
    install:
        extraKernelArgs:
        - selinux=0

and running talosctl upgrade commad, but it had no effect

Talos Linux 1.8 have no /sys/fs/selinux/enforce so this check returns false:

• https://github.com/kubevirt/kubevirt/blob/9120e62feedcb842be595a9d1069e305c07d01b9/cmd/virt-chroot/selinux.go#L27

[frezbo]

talos 1.9 has only selinux compiled and not even enabled at all, this is rather a an upstream issue on how they check if selinux is enabled

[kvaps]

Hey @frezbo,
I have built Talos 1.9 using this config
https://github.com/aenix-io/cozystack/blob/c6edf6cb9ea828065885015e3a0b164ee3cddf1a/packages/core/installer/images/talos/profiles/installer.yaml

Selinux is enabled, but in permissive mode:

• There is no oportunity to disable selinux. (to make /sys/fs/selinux/enforce disapear completely)
• And when SELinux loaded, KubeVirt can't work even withpermissive mode, because getxattr system call is blocked by Talos

[kvaps]

I just found similar issue in KubeVirt project
kubevirt/kubevirt#13607

[frezbo]

• There is no oportunity to disable selinux. (to make /sys/fs/selinux/enforce disapear completely)

but just having selinux fs mounted doesn;t mean it's enabled at all, you still need selinux=1 to enable it

And when SELinux loaded, KubeVirt can't work even withpermissive mode, because getxattr system call is blocked by Talos

Talos doesn't do anything in this regard, it probably kubevirt trying to access getxattr when selinux is not enabled

[frezbo]

@dsseng tagging you here just to make sure we don't do anything wrong

[dsseng]

• There is no oportunity to disable selinux. (to make /sys/fs/selinux/enforce disapear completely)

but just having selinux fs mounted doesn;t mean it's enabled at all, you still need selinux=1 to enable it

And when SELinux loaded, KubeVirt can't work even withpermissive mode, because getxattr system call is blocked by Talos

Talos doesn't do anything in this regard, it probably kubevirt trying to access getxattr when selinux is not enabled

True. Mere existence of SELinux filesystem should not decline any permissions.

I will take a look at what KubeVirt does and whether or not SELinux could affect that in disabled mode but with selinuxfs, maybe if that's the case we should mount selinuxfs conditionally.

[kvaps]

Okay I found workaround:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: disable-selinux
  namespace: cozy-kubevirt
  labels:
    app: disable-selinux
spec:
  selector:
    matchLabels:
      app: disable-selinux
  template:
    metadata:
      labels:
        app: disable-selinux
    spec:
      containers:
      - command:
        - sh
        - -exc
        - test -f /host/sys/fs/selinux/enforce && mount -t tmpfs tmpfs /host/sys/fs/selinux || sleep infinity
        image: docker.io/library/alpine
        name: mount
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /host
          mountPropagation: Bidirectional
          name: host-root
      hostIPC: true
      hostNetwork: true
      hostPID: true
      tolerations:
      - operator: Exists
      volumes:
      - hostPath:
          path: /
        name: host-root

[dsseng]

So okay, this means kubevirt breaks with selinuxfs mounted but policy not loaded. As I see from its code, it uses conventional Linux methods for querying SELinux (like getenforce from the container), which seem to interpret has selinuxfs but no policy as permissive mode.

From our side the fix should be not mounting selinuxfs when not enabling SELinux. This is what I am going to do right now. This change will likely be backported to 1.9 and released with the next point release.

[frezbo]

So okay, this means kubevirt breaks with selinuxfs mounted but policy not loaded. As I see from its code, it uses conventional Linux methods for querying SELinux (like getenforce from the container), which seem to interpret has selinuxfs but no policy as permissive mode.

From our side the fix should be not mounting selinuxfs when not enabling SELinux. This is what I am going to do right now. This change will likely be backported to 1.9 and released with the next point release.

I also think upstream should do a better check

[dsseng]

It also should. But actually mounting selinuxfs is not necessary and takes some time, even minor, so perhaps we better mount it conditionally.