opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-05-21 17:16:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

Don't relabel volumes if running in a privileged container

Browse Source 
Docker does not relabel this content, and openstack is running
containers in this manner.  There is a penalty for doing this
on each container, that is not worth taking on a disable SELinux
container.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2021-03-30 16:46:52 -04:00
parent 3fae801a37
commit 6831c72f6a
2 changed files with 36 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libpod/container_internal_linux.go
View File

@ -376,8 +376,14 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
case "z":
fallthrough
case "Z":
if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
return nil, err
if c.MountLabel() != "" {
if c.ProcessLabel() != "" {
if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
return nil, err
}
} else {
logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID())
}
}
default:

28
test/system/410-selinux.bats
View File

@ -191,5 +191,33 @@ function check_label() {
is "$output" "Error.*: \`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" "useful diagnostic"
}
@test "podman selinux: check relabel" {
skip_if_no_selinux
LABEL="system_u:object_r:tmp_t:s0"
tmpdir=$PODMAN_TMPDIR/vol
touch $tmpdir
chcon -vR ${LABEL} $tmpdir
ls -Z $tmpdir
run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
level=$(secon -l $output)
run ls -dZ ${tmpdir}
is "$output" ${LABEL} "No Relabel Correctly"
run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current
level=$(secon -l $output)
run ls -dZ $tmpdir
is "$output" ${LABEL} "No Privileged Relabel Correctly"
run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
level=$(secon -l $output)
run ls -dZ $tmpdir
is "$output" "system_u:object_r:container_file_t:$level" "Confined Relabel Correctly"
run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
run ls -dZ $tmpdir
is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly"
}
# vim: filetype=sh