Kubevirt 1.40.0 seems to be broken in 1.9.0

[nahsi]

Seems like a bug in kubevirt where it wrongly assumes that selinux is in permissive mode when it is actually disabled (possibly because /sys/fs/selinux) exists.

When starting a vm we get

❯ kubectl -n kubevirt logs virt-handler-2fttw | grep selinux
Defaulted container "virt-handler" out of: virt-handler, virt-launcher (init)
Error: failed to get selinux label for file /proc/self/fd/4: error reading fgetxattr: no data available
  virt-chroot selinux relabel [flags]
virt-chroot selinux relabel <new-label> <file-path>
failed to get selinux label for file /proc/self/fd/4: error reading fgetxattr: no data available
{"component":"virt-handler","level":"error","msg":"Relabeling a file faild, continuing since selinux is permissive.","pos":"labels.go:186","reason":"error relabeling file root: /, relative: /dev/net/tun with label system_u:object_r:container_file_t:s0. Reason: exit status 1","timestamp":"2024-12-25T09:43:54.899733Z"}
Error: failed to get selinux label for file /proc/self/fd/3: error reading fgetxattr: no data available
  virt-chroot selinux relabel [flags]
virt-chroot selinux relabel <new-label> <file-path>
failed to get selinux label for file /proc/self/fd/3: error reading fgetxattr: no data available
{"component":"virt-handler","level":"error","msg":"Relabeling a file faild, continuing since selinux is permissive.","pos":"labels.go:186","reason":"error relabeling file root: /, relative: /dev/null with label system_u:object_r:container_file_t:s0. Reason: exit status 1","timestamp":"2024-12-25T09:43:54.901980Z"}
{"component":"virt-handler","level":"error","msg":"failed to configure pod network","pos":"netpod.go:200","reason":"could not retrieve pid 20913 selinux label: getxattr /proc/20913/attr/current: operation not supported","timestamp":"2024-12-25T09:54:16.256900Z"}
{"component":"virt-handler","kind":"","level":"error","msg":"Synchronizing the VirtualMachineInstance failed.","name":"0000000000000000000000000000000000000000000000000000000000000011","namespace":"0xb994940f0a9b6b8d32b25d57b6ef7c49c00316ea","pos":"vm.go:2146","reason":"failed to configure vmi network: setup failed, err: Critical network error: could not retrieve pid 20913 selinux label: getxattr /proc/20913/attr/current: operation not supported","timestamp":"2024-12-25T09:54:16.256983Z","uid":"6cc6ea97-cbc9-43c4-8fc3-7117cf6766b6"}
{"component":"virt-handler","level":"info","msg":"re-enqueuing VirtualMachineInstance 0xb994940f0a9b6b8d32b25d57b6ef7c49c00316ea/0000000000000000000000000000000000000000000000000000000000000011","pos":"vm.go:1807","reason":"failed to configure vmi network: setup failed, err: Critical network error: could not retrieve pid 20913 selinux label: getxattr /proc/20913/attr/current: operation not supported","timestamp":"2024-12-25T09:54:16.268489Z"}
{"component":"virt-handler","level":"error","msg":"failed to configure pod network","pos":"netpod.go:200","reason":"could not retrieve pid 21966 selinux label: getxattr /proc/21966/attr/current: operation not supported","timestamp":"2024-12-25T09:54:29.230349Z"}
{"component":"virt-handler","kind":"","level":"error","msg":"Synchronizing the VirtualMachineInstance failed.","name":"0000000000000000000000000000000000000000000000000000000000000011","namespace":"0xb994940f0a9b6b8d32b25d57b6ef7c49c00316ea","pos":"vm.go:2146","reason":"failed to configure vmi network: setup failed, err: Critical network error: could not retrieve pid 21966 selinux label: getxattr /proc/21966/attr/current: operation not supported","timestamp":"2024-12-25T09:54:29.230451Z","uid":"f89f069d-b309-4b6a-8574-ecf08f3ea024"}
{"component":"virt-handler","level":"info","msg":"re-enqueuing VirtualMachineInstance 0xb994940f0a9b6b8d32b25d57b6ef7c49c00316ea/0000000000000000000000000000000000000000000000000000000000000011","pos":"vm.go:1807","reason":"failed to configure vmi network: setup failed, err: Critical network error: could not retrieve pid 21966 selinux label: getxattr /proc/21966/attr/current: operation not supported","timestamp":"2024-12-25T09:54:29.240911Z"}

I'm now looking for a way to unmount /sys/fs/selinux as a workaround.

[smira]

There would be a bug in KubeVirt probably, as SELinux is not enabled by default.

You can try adding selinux=1 to Talos boot kernel args to make SELinux enabled (but permissive mode).

[nahsi]

I tried that, checked that selinux is enabled and set to permissive but kubevirt still fails.

In similar issues in kubevirt repo (like this kubevirt/kubevirt#11525) some people suggest to do sudo apt install selinux-basics selinux-utils on ubuntu as a workaround.

Would be nice to have a parameter in machine config that manages selinux and allows to disable it completly, including not mounting /sys/fs/selinux.

[smira]

I'm still not sure what's up exactly to be helpful here. The fact that the filesystem is mounted shouldn't break anything.

[frezbo]

If just sysfs existing is the check kubevirt does that seems to be a bug that needs to be filed upstream