opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-28 22:53:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

set process labels in pkg/spec

Browse Source 
Set the (default) process labels in `pkg/spec`. This way, we can also
query libpod.conf and disable labeling if needed.

Fixes: #5087
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
This commit is contained in:
Valentin Rothberg
2020-02-18 15:01:18 +01:00
parent b7b9f8d0cf
commit 58cbbbc56e
2 changed files with 20 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
cmd/podman/shared/create.go
View File

@ -701,9 +701,6 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
Sysctl: sysctl, Sysctl: sysctl,
} }
if err := secConfig.SetLabelOpts(runtime, pid, ipc); err != nil {
return nil, err
}
if err := secConfig.SetSecurityOpts(runtime, c.StringArray("security-opt")); err != nil { if err := secConfig.SetSecurityOpts(runtime, c.StringArray("security-opt")); err != nil {
return nil, err return nil, err
} }

28
pkg/spec/spec.go
View File

@ -241,14 +241,6 @@ func (config *CreateConfig) createConfigToOCISpec(runtime *libpod.Runtime, userM
} }
// SECURITY OPTS // SECURITY OPTS
g.SetProcessNoNewPrivileges(config.Security.NoNewPrivs)
if !config.Security.Privileged {
g.SetProcessApparmorProfile(config.Security.ApparmorProfile)
}
blockAccessToKernelFilesystems(config, &g)
var runtimeConfig *libpodconfig.Config var runtimeConfig *libpodconfig.Config
if runtime != nil { if runtime != nil {
@ -258,6 +250,26 @@ func (config *CreateConfig) createConfigToOCISpec(runtime *libpod.Runtime, userM
} }
} }
g.SetProcessNoNewPrivileges(config.Security.NoNewPrivs)
if !config.Security.Privileged {
g.SetProcessApparmorProfile(config.Security.ApparmorProfile)
}
// Unless already set via the CLI, check if we need to disable process
// labels or set the defaults.
if len(config.Security.LabelOpts) == 0 && runtimeConfig != nil {
if !runtimeConfig.EnableLabeling {
// Disabled in the config.
config.Security.LabelOpts = append(config.Security.LabelOpts, "disable")
} else if err := config.Security.SetLabelOpts(runtime, &config.Pid, &config.Ipc); err != nil {
// Defaults!
return nil, err
}
}
blockAccessToKernelFilesystems(config, &g)
// RESOURCES - PIDS // RESOURCES - PIDS
if config.Resources.PidsLimit > 0 { if config.Resources.PidsLimit > 0 {
// if running on rootless on a cgroupv1 machine or using the cgroupfs manager, pids // if running on rootless on a cgroupv1 machine or using the cgroupfs manager, pids