When applying the exact same SCC as privildged, pod cannot access the hostpath

[yasharne]

Hi
I have created a SCC with exact same content as privileged SCC (with higher priority):

allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
allowHostPorts: true
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
allowedCapabilities:
- '*'
allowedUnsafeSysctls:
- '*'
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
 type: RunAsAny
groups:
- system:cluster-admins
- system:nodes
- system:masters
kind: SecurityContextConstraints
metadata:
 annotations:
   kubernetes.io/description: 'privileged allows access to all privileged and host features and the ability to run as any user, any group, any fsGroup, and with any SELinux context.  WARNING: this is the most relaxed SCC and should be used only for cluster administration. Grant with caution.'
 name: test-scc
priority: 15
readOnlyRootFilesystem: false
requiredDropCapabilities: null
runAsUser:
 type: RunAsAny
seLinuxContext:
 type: RunAsAny
seccompProfiles:
- '*'
supplementalGroups:
 type: RunAsAny
users:
- system:admin
- system:serviceaccount:openshift-infra:build-controller
volumes:
- '*'

and bound it to a serviceaccount:

oc adm policy add-scc-to-user test-scc -z test-sa -n ubuntu-test

and here is my deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ubuntu-test
  namespace: ubuntu-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ubuntu-test
  template:
    metadata:
      labels:
        app: ubuntu-test
    spec:
      serviceAccountName: test-sa
      containers:
      - name: ubuntu-test
        image: ubuntu:latest
        command: [ "/bin/bash", "-c", "--" ]
        args: [ "while true; do sleep 30; done;" ]
        resources:
          limits:
            cpu: 100m
            memory: 256Mi
        securityContext:
          runAsUser: 0
          runAsGroup: 0
        
        volumeMounts:
          - name: docker
            readOnly: true
            mountPath: /var/lib/docker/containers
          - name: containers
            readOnly: true
            mountPath: /var/log/containers
          - name: pods
            readOnly: true
            mountPath: /var/log/pods
      volumes:
        - name: docker
          hostPath:
            path: /var/lib/docker/containers
            type: ''
        - name: containers
          hostPath:
            path: /var/log/containers
            type: ''
        - name: pods
          hostPath:
            path: /var/log/pods
            type: ''

The hostPaths are mounted successfully but when I try to access the directories I get permission denied error:

root@ubuntu-test-54cbf88f9c-rlqm6:/# ls /var/log/    
alternatives.log  bootstrap.log     containers/       faillog           pods/             
apt/              btmp              dpkg.log          lastlog           wtmp              
root@ubuntu-test-54cbf88f9c-rlqm6:/# ls /var/log/pods
ls: cannot open directory '/var/log/pods': Permission denied

[vrutkovs]

Check pod annotations to ensure this scc was picked for the pod. Also, check if SELinux doesn't forbid listing these dirs

[yasharne]

Thanks @vrutkovs for your reply, the pod has openshift.io/scc: test-scc annotation, and if I run the pod with privileged: true it will show me the directory content, considering I'm using the same configuration as privileged SCC, is there any other place to configure the SELinux?

[vrutkovs]

is there any other place to configure the SELinux

It is being set on host. Also, selinux is just a guess, check that audit log doesn't have denials related to these dirs