Skip to content

Commit 5044a41

Browse files
committed
fix: mount /sys/kernel/security conditionally
When running in containers, specifically on Docker Desktop VMs, the securityfs might be missing. Fixes #9431 Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 0e6c983)
1 parent 83abb66 commit 5044a41

File tree

1 file changed

+7
-1
lines changed
  • internal/app/machined/pkg/system/services

1 file changed

+7
-1
lines changed

internal/app/machined/pkg/system/services/kubelet.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,11 +116,11 @@ func (k *Kubelet) Runner(r runtime.Runtime) (runner.Runner, error) {
116116
ID: k.ID(r),
117117
ProcessArgs: append([]string{"/usr/local/bin/kubelet"}, spec.Args...),
118118
}
119+
119120
// Set the required kubelet mounts.
120121
mounts := []specs.Mount{
121122
{Type: "bind", Destination: "/dev", Source: "/dev", Options: []string{"rbind", "rshared", "rw"}},
122123
{Type: "sysfs", Destination: "/sys", Source: "/sys", Options: []string{"bind", "ro"}},
123-
{Type: "securityfs", Destination: "/sys/kernel/security", Source: "/sys/kernel/security", Options: []string{"bind", "ro"}},
124124
{Type: "bind", Destination: constants.CgroupMountPath, Source: constants.CgroupMountPath, Options: []string{"rbind", "rshared", "rw"}},
125125
{Type: "bind", Destination: "/lib/modules", Source: "/lib/modules", Options: []string{"bind", "ro"}},
126126
{Type: "bind", Destination: "/etc/kubernetes", Source: "/etc/kubernetes", Options: []string{"bind", "rshared", "rw"}},
@@ -138,6 +138,12 @@ func (k *Kubelet) Runner(r runtime.Runtime) (runner.Runner, error) {
138138
{Type: "bind", Destination: "/var/log/pods", Source: "/var/log/pods", Options: []string{"rbind", "rshared", "rw"}},
139139
}
140140

141+
if _, err := os.Stat("/sys/kernel/security"); err == nil {
142+
mounts = append(mounts,
143+
specs.Mount{Type: "securityfs", Destination: "/sys/kernel/security", Source: "/sys/kernel/security", Options: []string{"bind", "ro"}},
144+
)
145+
}
146+
141147
// Add extra mounts.
142148
// TODO(andrewrynhard): We should verify that the mount source is
143149
// allowlisted. There is the potential that a user can expose

0 commit comments

Comments
 (0)