opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-07-02 16:57:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix SELinux labels of volumes

Browse Source 
If we attempt to label a volume and the file system
does not support labeling, then just warn.  SELinux
may or may not work, on the volume.

There is no way to setup a private label on a newly
created volume without using the container mountlabel.

If we don't have a mount label at the time of creation of
the volume, the only option we have is to create a shared
label.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2020-02-13 21:42:18 -05:00
parent 0c060dace1
commit b4fa6f4f08
3 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libpod/util_linux.go
View File

@ -92,7 +92,7 @@ func assembleSystemdCgroupName(baseSlice, newSlice string) (string, error) {
// LabelVolumePath takes a mount path for a volume and gives it an
// selinux label of either shared or not
func LabelVolumePath(path string, shared bool) error {
func LabelVolumePath(path string) error {
_, mountLabel, err := label.InitLabels([]string{})
if err != nil {
return errors.Wrapf(err, "error getting default mountlabels")
@ -100,12 +100,13 @@ func LabelVolumePath(path string, shared bool) error {
if err := label.ReleaseLabel(mountLabel); err != nil {
return errors.Wrapf(err, "error releasing label %q", mountLabel)
}
if err := label.Relabel(path, mountLabel, shared); err != nil {
permString := "private"
if shared {
permString = "shared"
if err := label.Relabel(path, mountLabel, true); err != nil {
if err != syscall.ENOTSUP {
logrus.Debugf("Labeling not supported on %q", path)
} else {
return errors.Wrapf(err, "error setting selinux label for %s to %q as shared", path, mountLabel)
}
return errors.Wrapf(err, "error setting selinux label for %s to %q as %s", path, mountLabel, permString)
}
return nil
}