opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-18 03:33:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

Ignore SELinux relabel on unsupported file systems

Browse Source 
We were ignoreing relabel requests on certain unsupported
file systems and not on others, this changes to consistently
logrus.Debug ENOTSUP file systems.

Fixes: https://github.com/containers/podman/discussions/20745

Still needs some work on the Buildah side.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2023-11-22 08:53:55 -05:00
parent b7ca114078
commit ddd6cdfd77
6 changed files with 49 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libpod/container_internal_common.go
View File

@ -869,7 +869,7 @@ func (c *Container) mountNotifySocket(g generate.Generator) error {
return fmt.Errorf("unable to create notify %q dir: %w", notifyDir, err)
}
}
if err := label.Relabel(notifyDir, c.MountLabel(), true); err != nil {
if err := c.relabel(notifyDir, c.MountLabel(), true); err != nil {
return fmt.Errorf("relabel failed %q: %w", notifyDir, err)
}
logrus.Debugf("Add bindmount notify %q dir", notifyDir)
@ -2288,7 +2288,7 @@ func (c *Container) bindMountRootFile(source, dest string) error {
if err := os.Chown(source, c.RootUID(), c.RootGID()); err != nil {
return err
}
if err := label.Relabel(source, c.MountLabel(), false); err != nil {
if err := c.relabel(source, c.MountLabel(), false); err != nil {
return err
}
@ -2824,7 +2824,7 @@ func (c *Container) createSecretMountDir(runPath string) error {
if err := umask.MkdirAllIgnoreUmask(src, os.FileMode(0o755)); err != nil {
return err
}
if err := label.Relabel(src, c.config.MountLabel, false); err != nil {
if err := c.relabel(src, c.config.MountLabel, false); err != nil {
return err
}
if err := os.Chown(src, c.RootUID(), c.RootGID()); err != nil {
@ -2927,7 +2927,12 @@ func (c *Container) relabel(src, mountLabel string, shared bool) error {
return nil
}
}
return label.Relabel(src, mountLabel, shared)
err := label.Relabel(src, mountLabel, shared)
if errors.Is(err, unix.ENOTSUP) {
logrus.Debugf("Labeling not supported on %q", src)
return nil
}
return err
}
func (c *Container) ChangeHostPathOwnership(src string, recurse bool, uid, gid int) error {