{"record":{"id":"b69941daff4f396e","repo":"hashicorp/nomad","slug":"w-s-b69941","errorCode":null,"errorMessage":"%w: \"%s\"","messagePattern":"%w: \"(.+?)\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/volumes.go","lineNumber":339,"sourceCode":"\tnv := new(VolumeMount)\n\t*nv = *v\n\treturn nv\n}\n\nfunc (v *VolumeMount) Validate() error {\n\tvar mErr *multierror.Error\n\n\t// Validate the task does not reference undefined volume mounts\n\tif v.Volume == \"\" {\n\t\tmErr = multierror.Append(mErr, errVolMountEmptyVol)\n\t}\n\n\tif !v.MountPropagationModeIsValid() {\n\t\tmErr = multierror.Append(mErr, fmt.Errorf(\"%w: %q\", errVolMountInvalidPropagationMode, v.PropagationMode))\n\t}\n\n\tif !v.SELinuxLabelIsValid() {\n\t\tmErr = multierror.Append(mErr, fmt.Errorf(\"%w: \\\"%s\\\"\", errVolMountInvalidSELinuxLabel, v.SELinuxLabel))\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\nfunc (v *VolumeMount) MountPropagationModeIsValid() bool {\n\tswitch v.PropagationMode {\n\tcase \"\", VolumeMountPropagationPrivate, VolumeMountPropagationHostToTask, VolumeMountPropagationBidirectional:\n\t\treturn true\n\tdefault:\n\t\treturn false\n\t}\n}\n\nfunc (v *VolumeMount) SELinuxLabelIsValid() bool {\n\tswitch v.SELinuxLabel {\n\tcase \"\", SELinuxSharedVolume, SELinuxPrivateVolume:\n\t\treturn true","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/volumes.go#L321-L357","documentation":"This is the formatted wrapper \"<err>: \\\"<label>\\\"\" produced in VolumeMount.Validate when SELinuxLabelIsValid() fails. It wraps errVolMountInvalidSELinuxLabel with the offending SELinuxLabel string, appended to the multierror.","triggerScenarios":"VolumeMount.Validate is called with a SELinuxLabel that is not \"\", \"z\", or \"Z\"; the error text reads \"volume mount has an invalid SELinux label: \\\"<value>\\\"\".","commonSituations":"Full SELinux context strings pasted into selinux_label; case errors (\"Z\" vs \"z\"); config copied from SELinux-hardened Docker setups.","solutions":["Set selinux_label to \"z\" or \"Z\", or clear it entirely.","Use the quoted value in the error to locate and correct the bad field.","Verify case-sensitivity — the valid labels are single characters."],"exampleFix":"// before\nSELinuxLabel: \"private\"\n// after\nSELinuxLabel: \"Z\"","handlingStrategy":"validation","validationCode":"if !mount.SELinuxLabelIsValid() {\n    return fmt.Errorf(\"bad SELinux label: %q\", mount.SELinuxLabel)\n}","typeGuard":"func isValidSELinuxLabel(l string) bool {\n    return l == \"\" || l == \"z\" || l == \"Z\"\n}","tryCatchPattern":"if err := mount.Validate(); err != nil {\n    if errors.Is(err, errVolMountInvalidSELinuxLabel) {\n        // fix selinux_label and retry\n    }\n}","preventionTips":["Use only \"z\"/\"Z\" or leave empty.","Handle case-sensitivity explicitly in config tooling."],"tags":["nomad","volumes","selinux","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}