Skip to content

Fix SELinux detection in driver scripts #626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ashutosh0x wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix SELinux detection in driver scripts #626

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion azurelinux/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,7 +237,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
8 changes: 1 addition & 7 deletions fedora/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,12 +338,6 @@ _get_module_params() {

# Load the kernel modules and start persistenced.
_load_driver() {
# Apply SELinux labels before loading modules
# if [ -e /sys/fs/selinux ]; then
# echo "Change module files security context to modules_file_t"
# chcon -R -t modules_object_t /lib/modules/$KERNEL_VERSION/kernel/drivers/video
# fi

echo "Parsing kernel module parameters..."
_get_module_params

Expand Down Expand Up @@ -501,7 +495,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
2 changes: 1 addition & 1 deletion rhel10/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -576,7 +576,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
8 changes: 5 additions & 3 deletions rhel10/ocp_dtk_entrypoint
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,9 +72,11 @@ nv-ctr-run-with-dtk() {
cp -rv "${MODULES_SHARED}"/* "${MODULES_LOCAL}"

# Tell SELinux to allow loading these files
find . -type f \
\( -name "*.txt" -or -name "*.go" \) \
-exec chcon -t modules_object_t "{}" \;
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
find . -type f \
\( -name "*.txt" -or -name "*.go" \) \
-exec chcon -t modules_object_t "{}" \;
fi

echo "#"
echo "# Executing nvidia-driver load script ..."
Expand Down
2 changes: 1 addition & 1 deletion rhel10/precompiled/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,7 +324,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
2 changes: 1 addition & 1 deletion rhel7/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
2 changes: 1 addition & 1 deletion rhel8/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -559,7 +559,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
8 changes: 5 additions & 3 deletions rhel8/ocp_dtk_entrypoint
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,9 +68,11 @@ nv-ctr-run-with-dtk() {
cp -rv "${MODULES_SHARED}"/* "${MODULES_LOCAL}"

# Tell SELinux to allow loading these files
find . -type f \
\( -name "*.txt" -or -name "*.go" \) \
-exec chcon -t modules_object_t "{}" \;
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
find . -type f \
\( -name "*.txt" -or -name "*.go" \) \
-exec chcon -t modules_object_t "{}" \;
fi

echo "#"
echo "# Executing nvidia-driver load script ..."
Expand Down
2 changes: 1 addition & 1 deletion rhel8/precompiled/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -301,7 +301,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
2 changes: 1 addition & 1 deletion rhel9/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -576,7 +576,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
8 changes: 5 additions & 3 deletions rhel9/ocp_dtk_entrypoint
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,9 +72,11 @@ nv-ctr-run-with-dtk() {
cp -rv "${MODULES_SHARED}"/* "${MODULES_LOCAL}"

# Tell SELinux to allow loading these files
find . -type f \
\( -name "*.txt" -or -name "*.go" \) \
-exec chcon -t modules_object_t "{}" \;
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
find . -type f \
\( -name "*.txt" -or -name "*.go" \) \
-exec chcon -t modules_object_t "{}" \;
fi

echo "#"
echo "# Executing nvidia-driver load script ..."
Expand Down
2 changes: 1 addition & 1 deletion rhel9/precompiled/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,7 +350,7 @@ _mount_rootfs() {
mount --rbind / ${RUN_DIR}/driver

echo "Check SELinux status"
if [ -e /sys/fs/selinux ]; then
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "SELinux is enabled"
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
Expand Down
6 changes: 4 additions & 2 deletions vgpu-manager/rhel8/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,10 @@ _mount_rootfs() {
mkdir -p ${RUN_DIR}/driver
mount --rbind / ${RUN_DIR}/driver

echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
fi
}

# Unmount the driver rootfs from the run directory.
Expand Down
6 changes: 4 additions & 2 deletions vgpu-manager/rhel9/nvidia-driver
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,10 @@ _mount_rootfs() {
mkdir -p ${RUN_DIR}/driver
mount --rbind / ${RUN_DIR}/driver

echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then
echo "Change device files security context for selinux compatibility"
chcon -R -t container_file_t ${RUN_DIR}/driver/dev
fi
}

# Unmount the driver rootfs from the run directory.
Expand Down