{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/6238","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/6238/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/6238/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/6238/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/6238","id":65527431,"number":6238,"title":"EmptyDir volume tmpfs mounts should have the correct selinux context set","user":{"login":"pmorie","id":366488,"avatar_url":"https://avatars.githubusercontent.com/u/366488?v=3","gravatar_id":"","url":"https://api.github.com/users/pmorie","html_url":"https://github.com/pmorie","followers_url":"https://api.github.com/users/pmorie/followers","following_url":"https://api.github.com/users/pmorie/following{/other_user}","gists_url":"https://api.github.com/users/pmorie/gists{/gist_id}","starred_url":"https://api.github.com/users/pmorie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmorie/subscriptions","organizations_url":"https://api.github.com/users/pmorie/orgs","repos_url":"https://api.github.com/users/pmorie/repos","events_url":"https://api.github.com/users/pmorie/events{/privacy}","received_events_url":"https://api.github.com/users/pmorie/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/component/kubelet","name":"component/kubelet","color":"0052cc"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/node","name":"team/node","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-03-31T19:24:42Z","updated_at":"2015-04-02T16:01:18Z","closed_at":null,"body":"Tmpfs mounts done by the `EmptyDir` volume plugin will by default receive a different security context than the kubelet root dir.  This results in AVC denials on reads from the container's selinux context while selinux is enforcing.  We should change the EmptyDir volume plugin to set the `rootcontext` option of the mount based on the selinux context of the kubelet rootdir.\r\n\r\nEventually this will touch the [security context work](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/design/security_context.md). "},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/88958763","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/6238#issuecomment-88958763","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/6238","id":88958763,"user":{"login":"thockin","id":5595220,"avatar_url":"https://avatars.githubusercontent.com/u/5595220?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false},"created_at":"2015-04-02T16:01:18Z","updated_at":"2015-04-02T16:01:18Z","body":"LGTM was provisional on your intent to do it right Real Soon :) and remove\nthat Host method - did I misinterpret?\n\nOn Thu, Apr 2, 2015 at 8:59 AM, Paul Morie <notifications@github.com> wrote:\n\n> @thockin <https://github.com/thockin> Does this change your LGTM on my\n> other pull?\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/GoogleCloudPlatform/kubernetes/issues/6238#issuecomment-88958370>\n> .\n>\n"}}