Toggle SELinux mode on Azure Container Linux (ACL) node pools for troubleshooting

This article shows you how to switch SELinux (Security-Enhanced Linux) from enforcing mode to permissive mode on Azure Container Linux (ACL) nodes in Azure Kubernetes Service (AKS) for troubleshooting purposes. This can be useful when you need to collect diagnostics or validate workload behavior that is being blocked by SELinux enforcement on ACL nodes.

Symptom

You need to collect diagnostics or validate workload behavior, but SELinux enforcement blocks the action on ACL nodes.

Cause

ACL nodes run SELinux in enforcing mode by default. To change behavior, you must apply the ACL security profile tag on the node pool.

Prerequisites

  • Azure CLI installed and signed in.
  • You know your AKS cluster name, resource group, and node pool name.
  • You can access a node for verification. For details, see Connect to AKS nodes with kubectl debug.

Resolution

To switch SELinux from enforcing mode to permissive mode on ACL nodes, you can either create a new ACL node pool or update an existing ACL node pool with the appropriate tag. The tag to set is acl-node-security-profile=selinux=permissive.

Option 1: Create a new ACL node pool in permissive mode

  1. Create a new ACL node pool in permissive mode using the az aks nodepool add command with the --tags parameter to set the ACL security profile tag.

    az aks nodepool add \
  --resource-group <resource-group-name> \
  --cluster-name <cluster-name> \
  --name <node-pool-name> \
  --node-count 1 \
  --tags acl-node-security-profile="selinux=permissive" \
  --no-wait

  2. Verify the tag was applied using the az aks show command to check the node pool profiles and their tags.

    az aks show \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --query "agentPoolProfiles[].{nodepoolName:name,tags:tags}"

    Example output:

    [
  {
    "nodepoolName": "<node-pool-name>",
    "tags": {
      "acl-node-security-profile": "selinux=permissive"
    }
  }
]

Option 2: Update an existing ACL node pool

  1. Update an existing ACL node pool to permissive mode using the az aks nodepool update command with the --tags parameter to set the ACL security profile tag.

    az aks nodepool update \
  --resource-group <resource-group-name> \
  --cluster-name <cluster-name> \
  --name <node-pool-name> \
  --tags acl-node-security-profile="selinux=permissive" \
  --no-wait

  2. Verify the tag was applied using the az aks show command to check the node pool profiles and their tags.

    az aks show \
  --resource-group <resource-group-name> \
  --name <cluster-name> \
  --query "agentPoolProfiles[].{nodepoolName:name,tags:tags}"

    Example output:

    [
  {
    "nodepoolName": "<node-pool-name>",
    "tags": {
      "acl-node-security-profile": "selinux=permissive"
    }
  }
]

  3. Restart the nodes in the node pool so the new SELinux mode takes effect.

Verification

  1. Connect to a node in the target pool using kubectl debug and chroot into the host filesystem.

  2. Run the sestatus command to check the current SELinux mode:

    sestatus

    In the output, confirm Current mode shows permissive. For example:

    SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

Related content

  • Last updated on