selinux permission denied, change mv to cp to maintain file context

[sahilbadla]

What type of PR is this?
bug

Which issue does this PR fix:
#2079

What does this PR do / Why do we need it:
This fixes the permissions issue experienced when SELinux enforcing mode is enabled. Entrypoint.sh script uses mv command(link) to write to host file system. When the aws-node container is killed or restarted it tries to write to the same file while has a different context(from the old container) and its not allowed by policies in SeLinux. To make it work with SeLinux, changing the mv command to cp works as cp maintains the context of file while writing.

Testing done on this change:
Unit testing
Tested with custom container image for amazon-k8s-cni

Automation added to e2e:

Will this PR introduce any new dependencies?:

Will this break upgrades or downgrades. Has updating a running cluster been tested?:

Does this change require updates to the CNI daemonset config files to work?:

Does this PR introduce any user-facing change?:
No

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[anusha-ragunathan]

Can you please a comment here explaining why we need to do this for SELinux? That way, folks looking at this later on wont optimize cp && rm for a mv and break SELinux

[sahilbadla]

looks like this solutions unblocks the crashloop problem but issue still persists. Even though the pods get restarted fine, the file /host/etc/cni/net.d/10-aws.conflist never gets replaced. Logs are something like this:
type=AVC msg=audit(1663054943.599:343637): avc: denied { write } for pid=851535 comm="cp" name="10-aws.conflist" dev="nvme0n1p1" ino=36708256 scontext=system_u:system_r:container_t:s0:c880,c964 tcontext=system_u:object_r:container_file_t:s0:c241,c852 tclass=file permissive=0
that means even cp is not working with enforcing mode as the file to be written is in the host. Closing this PR.