How do I enable SELinux in an NSP cluster?
Purpose
Perform this procedure to enable SELinux on the member nodes of an NSP cluster.
Note: You must enable permissive mode on all NSP cluster nodes before you can enable enforcing mode on the nodes.
Note: You require root user privileges on each NSP cluster node.
Note: A leading # character in a command line represents the root user prompt, and is not to be included in a typed command.
Steps
1 |
Perform Step 3 to Step 11 on each node in the NSP cluster. |
2 |
Go to Step 12. |
3 |
Log in as the root user on the NSP cluster node. |
4 |
Open a console window. |
5 |
Enter the following: # cd /opt/nsp/nsp-deployer/tools/selinux/tools/bin ↵ |
Check for required OS packages | |
6 |
Enter the following: # ./selinuxenable.sh -c ↵ Any missing OS packages required by SELinux are listed. |
7 |
If the message indicates that one or more required SELinux packages are not installed, enter the following: # dnf -y install package_1 package_2 ... package_n ↵ where package_1 package_2 ... package_n are the names of the listed packages The packages are installed. |
Enable permissive mode | |
8 |
# ./selinuxenable.sh -p ↵ The SELinux mode is set to permissive. |
Apply SELinux labels | |
9 |
Enter the following: # /opt/nsp/nsp-deployer/tools/selinux/installer/bin/nsp-selinux-config.bash ↵ The script loads the required AVC policy, k8s_nsp_domain.pp, and labels the files and directories named in the policy. |
10 |
Enter the following to back up the system audit logs: # cp /var/log/audit/audit.log* backup_location ↵ where backup_location is a secure location on a separate station |
11 |
Enter the following to delete the system audit logs and thereby clear the SELinux AVC history: # rm -f /var/log/audit/audit.log* ↵ |
Restart NSP cluster | |
12 |
Perform How do I stop an NSP cluster? to gracefully shut down the NSP cluster and preserve the cluster data. |
13 |
Enter the following: # systemctl reboot ↵ The node reboots. After the reboot, the SELinux labels take effect as SELinux runs in targeted permissive mode in the nsp_domain_t domain. |
14 |
After the reboot, enter the following to verify that the required processes are running in the nsp_domain_t domain: # ps -aefZ | egrep 'kube-apiserver | kube-scheduler | kube-controller-manager | /usr/local/bin/etcd | /usr/local/bin/kube-proxy | /usr/local/bin/kubelet|/kube-state-metrics | /usr/bin/kube-controllers' | egrep -v 'grep' ↵ Process entries like the following are listed: system_u:system_r:nsp_domain_t:s0 process_description |
15 |
If any listed entry does not include nsp_domain_t, contact technical support for assistance. |
16 |
Enter the following to verify that the policy file is loaded. # semodule -l | grep k8s_nsp_domain ↵ The policy file is listed, as shown below: k8s_nsp_domain |
17 |
Start the NSP cluster; perform How do I start an NSP cluster?. |
18 |
Close the open console windows. End of steps |