mirror of
https://github.com/containers/podman.git
synced 2025-06-21 01:19:15 +08:00
Merge pull request #10253 from rhatdan/relabel
Revert Patch to relabel if selinux not enabled
This commit is contained in:
@ -377,14 +377,8 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
|
|||||||
case "z":
|
case "z":
|
||||||
fallthrough
|
fallthrough
|
||||||
case "Z":
|
case "Z":
|
||||||
if c.MountLabel() != "" {
|
if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
|
||||||
if c.ProcessLabel() != "" {
|
return nil, err
|
||||||
if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID())
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
default:
|
default:
|
||||||
|
@ -198,20 +198,23 @@ function check_label() {
|
|||||||
skip_if_no_selinux
|
skip_if_no_selinux
|
||||||
|
|
||||||
LABEL="system_u:object_r:tmp_t:s0"
|
LABEL="system_u:object_r:tmp_t:s0"
|
||||||
|
RELABEL="system_u:object_r:container_file_t:s0"
|
||||||
tmpdir=$PODMAN_TMPDIR/vol
|
tmpdir=$PODMAN_TMPDIR/vol
|
||||||
touch $tmpdir
|
touch $tmpdir
|
||||||
chcon -vR ${LABEL} $tmpdir
|
chcon -vR ${LABEL} $tmpdir
|
||||||
ls -Z $tmpdir
|
ls -Z $tmpdir
|
||||||
|
|
||||||
run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
|
run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
|
||||||
level=$(secon -l $output)
|
|
||||||
run ls -dZ ${tmpdir}
|
run ls -dZ ${tmpdir}
|
||||||
is "$output" ${LABEL} "No Relabel Correctly"
|
is "$output" ${LABEL} "No Relabel Correctly"
|
||||||
|
|
||||||
run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current
|
run_podman run -v $tmpdir:/test:z --security-opt label=disable $IMAGE cat /proc/self/attr/current
|
||||||
level=$(secon -l $output)
|
|
||||||
run ls -dZ $tmpdir
|
run ls -dZ $tmpdir
|
||||||
is "$output" ${LABEL} "No Privileged Relabel Correctly"
|
is "$output" ${RELABEL} "Privileged Relabel Correctly"
|
||||||
|
|
||||||
|
run_podman run -v $tmpdir:/test:z --privileged $IMAGE cat /proc/self/attr/current
|
||||||
|
run ls -dZ $tmpdir
|
||||||
|
is "$output" ${RELABEL} "Privileged Relabel Correctly"
|
||||||
|
|
||||||
run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
|
run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
|
||||||
level=$(secon -l $output)
|
level=$(secon -l $output)
|
||||||
@ -220,7 +223,7 @@ function check_label() {
|
|||||||
|
|
||||||
run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
|
run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
|
||||||
run ls -dZ $tmpdir
|
run ls -dZ $tmpdir
|
||||||
is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly"
|
is "$output" ${RELABEL} "Shared Relabel Correctly"
|
||||||
}
|
}
|
||||||
|
|
||||||
# vim: filetype=sh
|
# vim: filetype=sh
|
||||||
|
Reference in New Issue
Block a user