Skip to content

container: fix cilium denial#621

Merged
pebenito merged 1 commit intoSELinuxProject:mainfrom
tormath1:tormath1/cilium
Jun 21, 2023
Merged

container: fix cilium denial#621
pebenito merged 1 commit intoSELinuxProject:mainfrom
tormath1:tormath1/cilium

Conversation

@tormath1
Copy link
Copy Markdown
Contributor

@tormath1 tormath1 commented Jun 21, 2023

Hello,

While testing Cilium CNI in a Kubernetes cluster, I noticed the following denials:

Jun 20 08:01:43 localhost audit[3480]: AVC avc:  denied  { open } for  pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1
Jun 20 08:01:43 localhost audit[3480]: AVC avc:  denied  { kernel } for  pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1
Jun 20 08:01:43 localhost audit[3480]: AVC avc:  denied  { cpu } for  pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1
Jun 20 08:01:43 localhost audit[3480]: AVC avc:  denied  { read } for  pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1

It has been seen with release 2.20221101 from Gentoo ebuilds on Flatcar operating system using Cilium 1.12.1 and 1.12.5

@tormath1
container: fix cilium denial
feaf607 
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
@tormath1 tormath1 mentioned this pull request Jun 21, 2023
Merged
3 tasks
@pebenito pebenito merged commit d4e64bb into SELinuxProject:main Jun 21, 2023
@tormath1 tormath1 deleted the tormath1/cilium branch June 22, 2023 06:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pebenito pebenito pebenito approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tormath1 @pebenito