What is the impact of SELinux on CRI-O

[alpana17]

There are multiple modes in which SELinux can be set. What is the impact of each mode on CRI-O?
Also, what is the idle setting for SELinux for CRI-O?
Different modes of SELinux are:

1. Enabled with PERMISSIVE mode
2. Enabled with ENFORCING mode
3. Disabled

According to https://www.redhat.com/en/blog/latest-container-exploit-runc-can-be-blocked-selinux document:
SELinux should be enabled in CRI-O to prevent certain vulnerabilities

[alpana17]

@haircommander please see

[alpana17]

Also, shall I take it as selinux in enforcing mode on host machine?

[haircommander]

yeah it's deprecated because soon we will interpret just the selinux enforcing mode on the host. So yeah set to enforcing on the host machine and selinux = true in cri-o and you should be good

[alpana17]

@haircommander selinux=true in /etc/crio/crio.conf
Right?

[haircommander]

yup correct!

[alpana17]

Thank you