where are log locations relevant to mount command?

[tooptoop4]

on a pod inside managed node group EKS i tried this command:

echo -e "username=${REDACTED}\npassword=${REDACTED}" > p.ini
mount -t cifs -o "domain=REDACTED,credentials=/p.ini,seal,vers=3.0" '\\REDACTED\REDACTED' /mnt/my_mount_dir --verbose

got below error:

mount.cifs kernel mount options: ip=REDACTED,unc=\\REDACTED\REDACTED,seal,vers=3.0,user=REDACTED,domain=REDACTED,prefixpath=REDACTED,pass=********
mount error(4): Interrupted system call
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg) 

where can i go to get more logs/details to debug the error? since i can't ssh to the worker nodes, i might need to add another log path to fluentbit

for context its trying to mount an onprem windows samba share. the same command worked on 'self managed eks running amazonlinux2'

[etungsten]

Hi @tooptoop4, if your node instance IAM role has the AmazonSSMManagedInstanceCore policy attached (which it should by default), then you should be able to access the instance via aws ssm start-session --target <instance-id>. Please check out https://github.com/bottlerocket-os/bottlerocket#control-container for more details.

Once you're in the control container, you can get a shell in the root host namespace by doing enter-admin-container then sudo sheltie. Since SELinux is in enforcing mode, you should be able to find dmesg for AVC denial errors related to your mount invocation.

Typically for the mount to work from within a container, the pod container needs to be privileged with the necessary capabilities and have the appropriate selinux labels attached to your pod through the securityContext. For example,

    securityContext:
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - SYS_ADMIN
      seLinuxOptions:
        user: system_u
        role: system_r
        type: super_t
        level: s0

Please note that this bypasses Bottlerocket security recommendations with regards to granting container privileged SELinux labels.