{"record":{"id":"deeebb49d29b93da","repo":"hashicorp/nomad","slug":"volume-mount-has-an-invalid-selinux-label","errorCode":null,"errorMessage":"volume mount has an invalid SELinux label","messagePattern":"volume mount has an invalid SELinux label","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/volumes.go","lineNumber":25,"sourceCode":"\t\"fmt\"\n\n\tmultierror \"github.com/hashicorp/go-multierror\"\n)\n\nconst (\n\tVolumeTypeHost = \"host\"\n\n\tVolumeMountPropagationPrivate       = \"private\"\n\tVolumeMountPropagationHostToTask    = \"host-to-task\"\n\tVolumeMountPropagationBidirectional = \"bidirectional\"\n\n\tSELinuxSharedVolume  = \"z\"\n\tSELinuxPrivateVolume = \"Z\"\n)\n\nvar (\n\terrVolMountInvalidPropagationMode = fmt.Errorf(\"volume mount has an invalid propagation mode\")\n\terrVolMountInvalidSELinuxLabel    = fmt.Errorf(\"volume mount has an invalid SELinux label\")\n\terrVolMountEmptyVol               = fmt.Errorf(\"volume mount references an empty volume\")\n)\n\n// ClientHostVolumeConfig is used to configure access to host paths on a Nomad Client\ntype ClientHostVolumeConfig struct {\n\tName     string `hcl:\",key\"`\n\tPath     string `hcl:\"path\"`\n\tReadOnly bool   `hcl:\"read_only\"`\n\t// ID is set for dynamic host volumes only.\n\tID string `hcl:\"-\"`\n}\n\nfunc (p *ClientHostVolumeConfig) Equal(o *ClientHostVolumeConfig) bool {\n\tif p == nil && o == nil {\n\t\treturn true\n\t}\n\tif p == nil || o == nil {\n\t\treturn false","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/volumes.go#L7-L43","documentation":"This error comes from VolumeMount.Validate when SELinuxLabel is set to a value outside the allowed set. The sentinel errVolMountInvalidSELinuxLabel is wrapped with the invalid label string. Valid labels are defined by constants such as SELinuxSharedVolume (\"z\") and SELinuxPrivateVolume (\"Z\").","triggerScenarios":"Calling Validate() on a VolumeMount whose SELinuxLabel is not \"\", \"z\", or \"Z\" — e.g. the test value \"very invalid selinux label\" — after SELinuxLabelIsValid() returns false.","commonSituations":"Users familiar with full SELinux context strings (e.g. system_u:object_r:...) pasting them into the selinux_label field; typos like lowercase/uppercase confusion ('z' vs 'Z'); config generated by other container tooling.","solutions":["Set selinux_label to \"z\" (shared) or \"Z\" (private), or remove it if SELinux labeling is not needed.","Remember the labels are case-sensitive: \"Z\" is private, \"z\" is shared.","Check the error suffix for the exact offending string and correct it."],"exampleFix":"// before\nselinux_label = \"system_u:object_r:container_file_t:s0\"\n// after\nselinux_label = \"z\"","handlingStrategy":"validation","validationCode":"validLabels := map[string]bool{\"\": true, \"z\": true, \"Z\": true}\nif !validLabels[mount.SELinuxLabel] {\n    return fmt.Errorf(\"invalid selinux_label %q\", mount.SELinuxLabel)\n}","typeGuard":"func isValidSELinuxLabel(l string) bool {\n    return l == \"\" || l == \"z\" || l == \"Z\"\n}","tryCatchPattern":null,"preventionTips":["Remember valid labels are only \"z\" (shared) and \"Z\" (private), case-sensitive.","Leave selinux_label unset unless SELinux relabeling is required.","Never paste full SELinux contexts into this field."],"tags":["nomad","volumes","selinux","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}