{"record":{"id":"c55f990aa7a2c80e","repo":"k3s-io/k3s","slug":"failed-to-detect-selinux-w","errorCode":null,"errorMessage":"failed to detect selinux: %w","messagePattern":"failed to detect selinux: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/agent/containerd/config_linux.go","lineNumber":101,"sourceCode":"\t\treturn fmt.Errorf(\"default runtime %s was not found\", cfg.DefaultRuntime)\n\t}\n\n\tcontainerdConfig := templates.ContainerdConfig{\n\t\tNodeConfig:            cfg,\n\t\tDisableCgroup:         disableCgroup,\n\t\tSystemdCgroup:         cfg.AgentConfig.Systemd,\n\t\tIsRunningInUserNS:     isRunningInUserNS,\n\t\tEnableUnprivileged:    kernel.CheckKernelVersion(4, 11, 0),\n\t\tNonrootDevices:        cfg.Containerd.NonrootDevices,\n\t\tPrivateRegistryConfig: cfg.AgentConfig.Registry,\n\t\tExtraRuntimes:         extraRuntimes,\n\t\tProgram:               version.Program,\n\t\tNoDefaultEndpoint:     cfg.Containerd.NoDefault,\n\t}\n\n\tselEnabled, selConfigured, err := selinuxStatus()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to detect selinux: %w\", err)\n\t}\n\tswitch {\n\tcase !cfg.SELinux && selEnabled:\n\t\tlogrus.Warn(\"SELinux is enabled on this host, but \" + version.Program + \" has not been started with --selinux - containerd SELinux support is disabled\")\n\tcase cfg.SELinux && !selConfigured:\n\t\tlogrus.Warnf(\"SELinux is enabled for \"+version.Program+\" but process is not running in context '%s', \"+version.Program+\"-selinux policy may need to be applied\", SELinuxContextType)\n\t}\n\n\tif err := writeContainerdConfig(cfg, containerdConfig); err != nil {\n\t\treturn err\n\t}\n\n\treturn writeContainerdHosts(cfg, containerdConfig)\n}\n\nfunc Client(address string) (*containerd.Client, error) {\n\taddr, _, err := util.GetAddressAndDialer(socketPrefix + address)\n\tif err != nil {","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/agent/containerd/config_linux.go#L83-L119","documentation":"Before writing the containerd config, the agent calls selinuxStatus() (pkg/agent/containerd/selinux.go): selinux.GetEnabled, then CurrentLabel and NewContext to determine whether the process runs in the container_runtime_t context. Any failure from CurrentLabel/NewContext — e.g. cannot read the process label or an unparseable context — is wrapped as 'failed to detect selinux: ...'.","triggerScenarios":"The host reports SELinux enabled (GetEnabled true) but reading or parsing the process's SELinux label fails: unusual LSM setups, selinuxfs at a nonstandard path, restricted /proc access, or a malformed current label.","commonSituations":"Hardened or nested environments; chroots without a proper /proc mount; hosts with a broken SELinux installation; containers pretending to be hosts.","solutions":["Inspect the wrapped cause in the full error text (it is a %w wrap)","Give the host a consistent SELinux state: getenforce reports Enforcing/Permissive with /sys/fs/selinux mounted, or SELinux is fully disabled kernel-side","Run the agent as root in a normal host context so label detection can read the process context"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := containerd.Configure(cfg); err != nil {\n    var wrapped *url.Error // placeholder: unwrap with errors.Unwrap to find the selinux cause\n    if strings.Contains(err.Error(), \"failed to detect selinux\") {\n        // inspect errors.Unwrap(err): reading /proc label vs parsing context\n        // fix host SELinux state, then retry once\n    }\n}","preventionTips":["Keep the host SELinux state consistent (enabled+mounted, or disabled kernel-wide) before deploying","Run agents as root in a normal host context, not inside broken chroots","Always read the wrapped cause — 'failed to detect selinux' alone does not say what broke"],"tags":["selinux","linux","containerd","host","security"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}