| *** sameo has quit IRC | 00:37 | |
| *** eernst has joined #kata-dev | 00:43 | |
| *** fuentess has quit IRC | 02:22 | |
| *** dlw has joined #kata-dev | 02:34 | |
| *** zerocoolback has joined #kata-dev | 02:47 | |
| *** ace__ has joined #kata-dev | 03:15 | |
| *** marcov has joined #kata-dev | 03:18 | |
| ace__ | hi | 03:19 |
|---|---|---|
| ace__ | can I raise a problem here? | 03:20 |
| *** ace__ has quit IRC | 03:20 | |
| *** zerocoolback has quit IRC | 03:30 | |
| *** zerocoolback has joined #kata-dev | 03:31 | |
| *** zerocoolback has quit IRC | 03:37 | |
| eernst | syre. | 03:47 |
| *** zerocoolback has joined #kata-dev | 04:09 | |
| *** zerocoolback has quit IRC | 04:14 | |
| *** zerocoolback has joined #kata-dev | 04:14 | |
| *** sjas_ has joined #kata-dev | 04:22 | |
| *** sjas has quit IRC | 04:25 | |
| *** eernst has quit IRC | 04:44 | |
| *** eernst has joined #kata-dev | 04:45 | |
| *** eernst has quit IRC | 04:49 | |
| *** jodh has joined #kata-dev | 06:14 | |
| *** jodh has quit IRC | 06:14 | |
| *** jodh has joined #kata-dev | 06:14 | |
| *** sameo has joined #kata-dev | 07:44 | |
| *** davidgiluk has joined #kata-dev | 08:03 | |
| *** gwhaley has joined #kata-dev | 08:04 | |
| *** zerocoolback has quit IRC | 08:26 | |
| *** zerocoolback has joined #kata-dev | 08:27 | |
| *** zerocoolback has quit IRC | 09:33 | |
| xzr | hmm okay, minor update on my quest to enable selinux, I've rebuilt the kernel with the selinux associated flags enabled, built my own os image with selinux packages included, switched those in for kata (kata-env reports correct ones), but still getting disabled for sestatus inside the container | 10:03 |
| xzr | any ideas on what I could be missing? | 10:04 |
| gwhaley | hi xzr - not sure if you have seen or are tracking the PRs from nitkon wrt seccomp? I think there are a set of 3 PRs across 3 repos (agent, runtime and ... err, probably osbuilder/image iirc). Here is main thread I think: https://github.com/kata-containers/agent/pull/353 | 10:08 |
| gwhaley | oh, hold on, now I have to correlate seccomp/selinux in my head (mea culpa...!) | 10:09 |
| gwhaley | right, maybe scrub that.... back to selinux :-) | 10:10 |
| gwhaley | xzr: in short, no, sorry. Not an selinux person really - I think we'll have to at least see the failure line/log - presuming you run an selinux status check command that fails or you have something in dmesg? | 10:11 |
| davidgiluk | xzr: My reading of libselinux (I don't know it well) is that it comes down to whether the selinux fs is mounted | 10:14 |
| davidgiluk | xzr: So I think you need to get /sys/fs/selinux mounted inside the guest | 10:16 |
| xzr | thanks davidgiluk, I'll take a looksy | 10:17 |
| xzr | gwhaley: just the "disabled" output from sestatus | 10:17 |
| xzr | the same check works for "regular" containers | 10:17 |
| davidgiluk | xzr: That was just following the breadcrumbs from the code that printed 'enabled' in the selinux utils | 10:17 |
| xzr | atleast it would seem that it doesn't exist when running my kata images :) | 10:24 |
| xzr | exists when I spin up a container with runc | 10:24 |
| xzr | so likely something there! | 10:24 |
| gwhaley | xzr, davidgiluk: that fs mount sounds like a likely candidate. If it is not explicitly passed into the container in the json config, then the agent in the VM is probably not going to mount it. | 10:28 |
| gwhaley | if you want to try to hand-force the mount, you will need to add the SYS_ADMIN cap to the container at runtime to allow you to do the hand mount btw I think | 10:29 |
| xzr | ah hmm, could also be that my method is slightly misled | 10:32 |
| xzr | https://serverfault.com/questions/757606/how-to-enable-selinux-inside-of-a-centos-docker-container | 10:32 |
| davidgiluk | yeh but kata isn't the same | 10:33 |
| davidgiluk | you've got your own kernel instance in there, so that needs configuring with se; although then there's the fun question of what's actually used to access the files if it's going through 9p; and hmmm that's probably a whole different quesiton | 10:35 |
| xzr | well with the kernel comes the "thin" os between the container and the kernel as well though? | 10:36 |
| xzr | so in the thin os it could be enabled, but checking if selinux is enabled in the container like that might not work | 10:37 |
| xzr | feel free to correct, my knowledge on kata is extremely thin | 10:37 |
| davidgiluk | my knowledge of what 9p looks like to selinux is no thicker | 10:37 |
| gwhaley | just for ref, we have both 9p mounts and the ability to do block device mounts given the right input (such as devicemaper on the host side) :-) Just to add to the mix | 10:39 |
| davidgiluk | gwhaley: Well, block devices are in principal simple; that's vanilla selinux, that would all be the view of the guest | 10:39 |
| gwhaley | yep - they should 'act as expected' I would think. I'll go peek at that 'selinux in a container' link to see if any prime kata differences leap out.. | 10:40 |
| davidgiluk | gwhaley: I think it's different in almost every way :-) | 10:40 |
| xzr | hmm | 10:41 |
| xzr | clear containers 3.0 seems to have support for selinux within guest | 10:41 |
| gwhaley | heh, indeed it is davidgiluk. Interesting to see that selinux is not namespaced. That might come into play with multi-container-pods and kata - you'd end up similar to software containers, where the selinux policy would apply to all containers. | 10:43 |
| gwhaley | if we ignore the discussion of if 9p gets checked by selinux for now, let's chase that mount. | 10:47 |
| gwhaley | xzr, when you say CC3.0 had selinux support - do you have a link. Having a look at the repo/history, I can see we added support to the HOST side installation to allow the proxy to be recognised/enabled under an selinux enabled host. I'm not sure if we have guest support though. | 10:48 |
| xzr | just this https://clearlinux.org/blogs/announcing-intel-clear-containers-30 | 10:54 |
| xzr | yet to dig into the implementation | 10:54 |
| xzr | "Clear Containers 3.0 introduces a libcontainer based agent which enables the application of policies and filters such as SELinux* and seccomp inside the Clear Containers guest. " | 10:54 |
| gwhaley | ah, right - that is noting when we moved to an agent that uses libcontainer so then we inherited all the 'features' from that library that runc had. we'll have to track down what work got done there - iirc, it was probably archana (amshinde) who was most involved. | 10:57 |
| xzr | seems the correct way to check selinux inside the container is to run ps -eZ | 11:06 |
| davidgiluk | hmm, that's an odd way | 11:08 |
| xzr | you see if the labeling is working then I reckon | 11:09 |
| xzr | https://pastebin.com/aaqiYTMV | 11:10 |
| xzr | https://youtu.be/zWGFqMuEHdw?t=1902 | 11:11 |
| *** gwhaley has quit IRC | 11:11 | |
| xzr | ah slightly different with --selinux-enabled with docker, forgot that from the previous | 11:15 |
| xzr | https://pastebin.com/Tggj7TfJ | 11:15 |
| davidgiluk | yeh it's a way to see if it's working, but it's a pain to automate compared to the tools | 11:27 |
| xzr | for sure | 11:27 |
| xzr | anyway, I'll keep digging and see what I can come up with | 11:28 |
| xzr | but if there's some selinux expertise from the guys coming from the clearlinux side of things, that would surely be extremely helpful | 11:28 |
| xzr | erm, clearcontainers | 11:28 |
| *** eernst has joined #kata-dev | 11:31 | |
| *** dlw has quit IRC | 11:43 | |
| *** zerocoolback has joined #kata-dev | 12:12 | |
| *** jugs has quit IRC | 12:16 | |
| *** jugs has joined #kata-dev | 12:19 | |
| *** zerocoolback has quit IRC | 12:20 | |
| *** zerocool_ has joined #kata-dev | 12:21 | |
| *** gwhaley has joined #kata-dev | 12:21 | |
| *** devimc has joined #kata-dev | 12:30 | |
| *** eernst has quit IRC | 12:33 | |
| *** eernst has joined #kata-dev | 13:00 | |
| *** eernst has quit IRC | 13:21 | |
| *** fuentess has joined #kata-dev | 13:41 | |
| *** zerocool_ has quit IRC | 13:49 | |
| *** annabelleB has joined #kata-dev | 14:00 | |
| gwhaley | fuentess - woot - we got a metrics CI build pass on the packet.net slave.... http://jenkins.katacontainers.io/job/kata-metrics-proxy-ubuntu-18-04-PR/14/ | 14:04 |
| fuentess | gwhaley: cool \o/ | 14:04 |
| gwhaley | I'll probably go hook the shim and the agent soon and then we can keep a better eye on it, before we finally hook the runtime and tests repos | 14:05 |
| gwhaley | ah, which has just remineded me of another topic I was going to raise ..... if we can in any way cache build artifacts to reduce our CI times. Let me go do that now.... | 14:05 |
| fuentess | gwhaley: btw, I am going to add the ksm-throttler installation on the CI (as we currently do not have it), it will be disabled if running on the metrics CI machine | 14:06 |
| gwhaley | fuentess - great, thanks! :-) | 14:09 |
| fuentess | gwhaley: and yes, it could be great if we can cache on the metrics CI system. | 14:09 |
| gwhaley | fuentess - not just on the metrics system - ideally on all CIs. For instance, we must rebuild the proxy and shim all the time, whereas they very very rarely change. And the builds of the kernel and the .img files are the biggies .... let me write the Issue (in progress now) | 14:12 |
| kata-irc-bot | <jose.carlos.venegas.m> +1 | 14:12 |
| *** annabelleB has quit IRC | 14:43 | |
| *** sameo has quit IRC | 14:51 | |
| *** eernst has joined #kata-dev | 14:54 | |
| *** zerocoolback has joined #kata-dev | 14:55 | |
| *** jodh has quit IRC | 14:59 | |
| *** zerocoolback has quit IRC | 14:59 | |
| *** zerocool_ has joined #kata-dev | 15:00 | |
| *** eernst has quit IRC | 15:01 | |
| davidgiluk | the kata/qemu discussion is in 1 hr?? (says he always doubting his timezone conversions) | 15:01 |
| gwhaley | I never make that call davidgiluk, so am not sure - I normally make the Monday call. Also, there is devseccon on right now I believe, so at least Anne and Eric are there I think - so, not sure if the call is on today | 15:04 |
| davidgiluk | gwhaley: It's a one off that was going to be face-to-face but not many people are physically going to be there | 15:08 |
| *** eernst has joined #kata-dev | 15:17 | |
| kata-irc-bot | <eric.ernst> It should be on, davidgiluk | 15:18 |
| davidgiluk | ok, I'll dial in in about 40min | 15:18 |
| *** dklyle has joined #kata-dev | 15:28 | |
| kata-irc-bot | <sebastien.boeuf> yeah the meeting will happen in about 30min | 15:30 |
| *** sameo has joined #kata-dev | 15:32 | |
| *** eernst has quit IRC | 15:49 | |
| *** annabelleB has joined #kata-dev | 15:52 | |
| *** mcastelino has joined #kata-dev | 15:55 | |
| *** eernst has joined #kata-dev | 16:02 | |
| *** eernst has quit IRC | 16:32 | |
| *** hongbin_ has joined #kata-dev | 16:34 | |
| *** hongbin_ has quit IRC | 16:36 | |
| *** sameo has quit IRC | 16:37 | |
| *** gwhaley has quit IRC | 16:39 | |
| *** sameo has joined #kata-dev | 16:55 | |
| *** sameo has quit IRC | 17:29 | |
| *** sameo has joined #kata-dev | 17:30 | |
| *** eernst has joined #kata-dev | 17:44 | |
| *** gwhaley has joined #kata-dev | 17:47 | |
| *** annabelleB has quit IRC | 17:53 | |
| *** eernst has quit IRC | 17:54 | |
| *** annabelleB has joined #kata-dev | 17:57 | |
| *** annabelleB has quit IRC | 18:01 | |
| *** david-lyle has joined #kata-dev | 18:04 | |
| *** dklyle has quit IRC | 18:05 | |
| *** eernst has joined #kata-dev | 18:14 | |
| *** david-lyle has quit IRC | 18:57 | |
| *** eernst has quit IRC | 19:02 | |
| *** davidgiluk has quit IRC | 19:08 | |
| *** gwhaley has quit IRC | 19:32 | |
| *** sjas_ is now known as sjas | 19:54 | |
| *** david-lyle has joined #kata-dev | 19:58 | |
| *** annabelleB has joined #kata-dev | 20:08 | |
| *** annabelleB has quit IRC | 20:34 | |
| *** annabelleB has joined #kata-dev | 20:40 | |
| *** eernst has joined #kata-dev | 20:41 | |
| *** david-lyle has quit IRC | 20:41 | |
| *** dklyle has joined #kata-dev | 20:42 | |
| *** eernst has quit IRC | 20:51 | |
| kata-irc-bot | <jose.carlos.venegas.m> We just finish to release process for our first rc for 1.3.0 take a look to the release notes, thank you for all your contributions https://github.com/kata-containers/runtime/releases/tag/1.3.0-rc0 | 20:51 |
| *** zerocool_ has quit IRC | 20:56 | |
| *** devimc has quit IRC | 21:02 | |
| *** david-lyle has joined #kata-dev | 21:09 | |
| *** dklyle has quit IRC | 21:09 | |
| *** david-lyle is now known as dklyle | 21:10 | |
| *** annabelleB has quit IRC | 21:34 | |
| *** dklyle has quit IRC | 21:48 | |
| *** dklyle has joined #kata-dev | 21:48 | |
| *** dklyle has quit IRC | 22:01 | |
| *** mcastelino has quit IRC | 22:02 | |
| *** dklyle has joined #kata-dev | 22:10 | |
| *** annabelleB has joined #kata-dev | 22:16 | |
| *** dklyle has quit IRC | 22:44 | |
| *** annabelleB has quit IRC | 22:46 | |
| *** dklyle has joined #kata-dev | 23:00 | |
| *** dklyle has quit IRC | 23:38 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!