From ad191305e61853f336e4902bfeb9d9b73ecad60a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Doktor?= <ldoktor@redhat.com>
Date: Mon, 4 Dec 2023 09:56:15 +0100
Subject: [PATCH] ci/openshift-ci: Enable selinux in CI runs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

as kata-deploy does not currently handles selinux, this requires manual
relabel of the /opt/kata folder where custom binaries are deployed.

Fixes: https://github.com/kata-containers/tests/issues/5802

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
---
 .../cluster/deployments/relabel_selinux.yaml  | 22 +++++++++++++++++++
 .ci/openshift-ci/cluster/install_kata.sh      |  8 +++++++
 .ci/openshift-ci/test.sh                      |  2 +-
 3 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 .ci/openshift-ci/cluster/deployments/relabel_selinux.yaml

diff --git a/.ci/openshift-ci/cluster/deployments/relabel_selinux.yaml b/.ci/openshift-ci/cluster/deployments/relabel_selinux.yaml
new file mode 100644
index 000000000..d4f25ce5d
--- /dev/null
+++ b/.ci/openshift-ci/cluster/deployments/relabel_selinux.yaml
@@ -0,0 +1,22 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: relabel-selinux-daemonset
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      app: restorecon
+  template:
+    metadata:
+      labels:
+        app: restorecon
+    spec:
+      serviceAccountName: kata-deploy-sa
+      hostPID: true
+      containers:
+        - name: relabel-selinux-container
+          image: alpine
+          securityContext:
+            privileged: true
+          command: ["/bin/sh", "-c", "nsenter --target 1 --mount bash -xc \"for ENTRY in '/(.*/)?opt/kata/share/kata-.*(/.*)?(/.*)?' '/(.*/)?opt/kata/share/ovmf(/.*)?' '/(.*/)?opt/kata/share/tdvf(/.*)?' '/(.*/)?opt/kata/libexec(/.*)?'; do semanage fcontext -a -t qemu_exec_t \\\"\\$ENTRY\\\"; done; restorecon -v -R /opt/kata\"; echo NSENTER_FINISHED_WITH: $?; sleep infinity"]
diff --git a/.ci/openshift-ci/cluster/install_kata.sh b/.ci/openshift-ci/cluster/install_kata.sh
index af4787034..bc62854d7 100755
--- a/.ci/openshift-ci/cluster/install_kata.sh
+++ b/.ci/openshift-ci/cluster/install_kata.sh
@@ -181,3 +181,11 @@ if [ ${SELINUX_PERMISSIVE} == "yes" ]; then
 	# The new SELinux configuration will trigger another reboot.
 	wait_for_reboot
 fi
+
+# FIXME: Remove when https://github.com/kata-containers/kata-containers/pull/8417 is resolved
+# Selinux context is currently not handled by kata-deploy
+oc apply -f ${deployments_dir}/relabel_selinux.yaml
+( for I in $(seq 3); do
+	sleep 10
+	oc logs -n kube-system ds/relabel-selinux-daemonset | grep "NSENTER_FINISHED_WITH:" && exit
+done ) || { echo "Selinux relabel failed, check the logs"; exit -1; }
diff --git a/.ci/openshift-ci/test.sh b/.ci/openshift-ci/test.sh
index ad4ee6165..59cb5022a 100755
--- a/.ci/openshift-ci/test.sh
+++ b/.ci/openshift-ci/test.sh
@@ -19,7 +19,7 @@ export PATH=/tmp/shared:$PATH
 oc version || die "Test cluster is unreachable"
 
 info "Install and configure kata into the test cluster"
-export SELINUX_PERMISSIVE="yes"
+export SELINUX_PERMISSIVE="no"
 ${script_dir}/cluster/install_kata.sh || die "Failed to install kata-containers"
 
 info "Run test suite: $suite"