opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-17 03:04:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6827 from rhatdan/v1.6.4

Browse Source 
Disable SELinux labeling if privileged and user does not specify labels
This commit is contained in:
Matthew Heon
2020-06-30 14:59:34 -04:00
committed by GitHub
parent b9c363142f c734a6c44e
commit 2ff8dc2fdc
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
cmd/podman/shared/create.go
View File

@ -196,9 +196,7 @@ func CreateContainer(ctx context.Context, c *GenericCLIResults, runtime *libpod.
}
func parseSecurityOpt(config *cc.CreateConfig, securityOpts []string, runtime *libpod.Runtime) error {
var (
labelOpts []string
)
var labelOpts []string
if config.PidMode.IsHost() {
labelOpts = append(labelOpts, label.DisableSecOpt()...)
@ -794,12 +792,12 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
Syslog: c.Bool("syslog"),
}
if config.Privileged {
config.LabelOpts = label.DisableSecOpt()
}
if err := parseSecurityOpt(config, c.StringArray("security-opt"), runtime); err != nil {
return nil, err
}
if config.Privileged && len(config.LabelOpts) == 0 {
config.LabelOpts = label.DisableSecOpt()
}
config.SecurityOpts = c.StringArray("security-opt")
warnings, err := verifyContainerResources(config, false)
if err != nil {