opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-19 16:33:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5936 from rhatdan/selinux1

Browse Source 
Move selinux labeling support from pkg/util to pkg/selinux
This commit is contained in:
OpenShift Merge Robot
2020-04-22 22:30:59 +02:00
committed by GitHub
parent 576fe98bbc ede8380d37
commit 2584d6bd58
3 changed files with 43 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libpod/container_internal.go
View File

@ -19,7 +19,7 @@ import (
"github.com/containers/libpod/pkg/hooks"
"github.com/containers/libpod/pkg/hooks/exec"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/libpod/pkg/util"
"github.com/containers/libpod/pkg/selinux"
"github.com/containers/storage"
"github.com/containers/storage/pkg/archive"
"github.com/containers/storage/pkg/mount"
@ -435,12 +435,12 @@ func (c *Container) setupStorage(ctx context.Context) error {
processLabel := containerInfo.ProcessLabel
switch {
case c.ociRuntime.SupportsKVM():
processLabel, err = util.SELinuxKVMLabel(processLabel)
processLabel, err = selinux.SELinuxKVMLabel(processLabel)
if err != nil {
return err
}
case c.config.Systemd:
processLabel, err = util.SELinuxInitLabel(processLabel)
processLabel, err = selinux.SELinuxInitLabel(processLabel)
if err != nil {
return err
}

40
pkg/selinux/selinux.go Normal file
View File

@ -0,0 +1,40 @@
package selinux
import (
"github.com/opencontainers/selinux/go-selinux"
)
// SELinuxKVMLabel returns labels for running kvm isolated containers
func SELinuxKVMLabel(cLabel string) (string, error) {
if cLabel == "" {
// selinux is disabled
return "", nil
}
processLabel, _ := selinux.KVMContainerLabels()
selinux.ReleaseLabel(processLabel)
return swapSELinuxLabel(cLabel, processLabel)
}
// SELinuxInitLabel returns labels for running systemd based containers
func SELinuxInitLabel(cLabel string) (string, error) {
if cLabel == "" {
// selinux is disabled
return "", nil
}
processLabel, _ := selinux.InitContainerLabels()
selinux.ReleaseLabel(processLabel)
return swapSELinuxLabel(cLabel, processLabel)
}
func swapSELinuxLabel(cLabel, processLabel string) (string, error) {
dcon, err := selinux.NewContext(cLabel)
if err != nil {
return "", err
}
scon, err := selinux.NewContext(processLabel)
if err != nil {
return "", err
}
dcon["type"] = scon["type"]
return dcon.Get(), nil
}

36
pkg/util/utils.go
View File

@ -22,7 +22,6 @@ import (
"github.com/containers/storage"
"github.com/containers/storage/pkg/idtools"
v1 "github.com/opencontainers/image-spec/specs-go/v1"
"github.com/opencontainers/selinux/go-selinux"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"golang.org/x/crypto/ssh/terminal"
@ -647,41 +646,6 @@ func ValidateSysctls(strSlice []string) (map[string]string, error) {
return sysctl, nil
}
// SELinuxKVMLabel returns labels for running kvm isolated containers
func SELinuxKVMLabel(cLabel string) (string, error) {
if cLabel == "" {
// selinux is disabled
return "", nil
}
processLabel, _ := selinux.KVMContainerLabels()
selinux.ReleaseLabel(processLabel)
return swapSELinuxLabel(cLabel, processLabel)
}
// SELinuxInitLabel returns labels for running systemd based containers
func SELinuxInitLabel(cLabel string) (string, error) {
if cLabel == "" {
// selinux is disabled
return "", nil
}
processLabel, _ := selinux.InitContainerLabels()
selinux.ReleaseLabel(processLabel)
return swapSELinuxLabel(cLabel, processLabel)
}
func swapSELinuxLabel(cLabel, processLabel string) (string, error) {
dcon, err := selinux.NewContext(cLabel)
if err != nil {
return "", err
}
scon, err := selinux.NewContext(processLabel)
if err != nil {
return "", err
}
dcon["type"] = scon["type"]
return dcon.Get(), nil
}
func DefaultContainerConfig() *config.Config {
return containerConfig
}