security-profiles-operator: Cannot record Selinux Profile
What happened:
I am trying to record Selinux profile using Kind:SelinuxProfile profile recording
Here’s the manifest I am using
apiVersion: security-profiles-operator.x-k8s.io/v1alpha1 kind: ProfileRecording metadata: name: demo-selinux spec: kind: SelinuxProfile recorder: logs podSelector: matchLabels: app: se-demo
apiVersion: v1 kind: Pod metadata: name: nginx labels: app: se-demo spec: containers: - name: nginx image: nginx
when I looked used k describe profilerecording demo-selinux
, I was able to see nginx as active workload but no metrics were available on prometheus and when I deleted the pod I wasn’t able to find any Selinux profiles using being created using k get selinuxprofiles -A
Spec: Kind: SelinuxProfile Pod Selector: Match Labels: App: se-demo Recorder: logs Status: Active Workloads: nginx
I also tried checking in /var/log/audit/audit.log
on the node where the pod was deployed, there was no type=AVC
logs present which are generated when Selinux is in permissive mode
and there were no pod events as well for Selinux profile recording which happens for Seccomp profiles
Normal Pulling 28s kubelet Pulling image "nginx" Normal Pulled 25s kubelet Successfully pulled image "nginx" in 2.317645743s Normal Created 25s kubelet Created container nginx Normal Started 25s kubelet Started container nginx
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Comments: 19 (10 by maintainers)
Looks like Amazon Linux configures their policy store differently? See https://selinuxproject.org/page/PolicyStoreConfigurationFiles for what’s in their directory. I’ve frankly never used Amazon Linux myself, can you paste semanage.conf on one instance?