security-profiles-operator: Cannot record Selinux Profile

What happened:

I am trying to record Selinux profile using Kind:SelinuxProfile profile recording Here’s the manifest I am using apiVersion: security-profiles-operator.x-k8s.io/v1alpha1 kind: ProfileRecording metadata: name: demo-selinux spec: kind: SelinuxProfile recorder: logs podSelector: matchLabels: app: se-demo apiVersion: v1 kind: Pod metadata: name: nginx labels: app: se-demo spec: containers: - name: nginx image: nginx

when I looked used k describe profilerecording demo-selinux, I was able to see nginx as active workload but no metrics were available on prometheus and when I deleted the pod I wasn’t able to find any Selinux profiles using being created using k get selinuxprofiles -A

Spec: Kind: SelinuxProfile Pod Selector: Match Labels: App: se-demo Recorder: logs Status: Active Workloads: nginx I also tried checking in /var/log/audit/audit.log on the node where the pod was deployed, there was no type=AVC logs present which are generated when Selinux is in permissive mode and there were no pod events as well for Selinux profile recording which happens for Seccomp profiles Normal Pulling 28s kubelet Pulling image "nginx" Normal Pulled 25s kubelet Successfully pulled image "nginx" in 2.317645743s Normal Created 25s kubelet Created container nginx Normal Started 25s kubelet Started container nginx

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Comments: 19 (10 by maintainers)

Most upvoted comments

Looks like Amazon Linux configures their policy store differently? See https://selinuxproject.org/page/PolicyStoreConfigurationFiles for what’s in their directory. I’ve frankly never used Amazon Linux myself, can you paste semanage.conf on one instance?