containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert Patch to relabel if selinux not enabled 

Revert : https://github.com/containers/podman/pull/9895

Turns out that if Docker is in --selinux-enabeled, it still relabels if
the user tells the system to, even if running a --privileged container
or if the selinux separation is disabled --security-opt label=disable.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh 2021-05-06 17:41:04 -04:00
parent 034470e5be
commit f528511bf6
No known key found for this signature in database
GPG Key ID: A2DF901DABE2C028
2 changed files with 10 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libpod/container_internal_linux.go
View File

@ -377,14 +377,8 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
case "z": case "z":
fallthrough fallthrough
case "Z": case "Z":
if c.MountLabel() != "" { if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
if c.ProcessLabel() != "" { return nil, err
if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
return nil, err
}
} else {
logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID())
}
} }
default: default:

13
test/system/410-selinux.bats
View File

@ -198,20 +198,23 @@ function check_label() {
skip_if_no_selinux skip_if_no_selinux
LABEL="system_u:object_r:tmp_t:s0" LABEL="system_u:object_r:tmp_t:s0"
RELABEL="system_u:object_r:container_file_t:s0"
tmpdir=$PODMAN_TMPDIR/vol tmpdir=$PODMAN_TMPDIR/vol
touch $tmpdir touch $tmpdir
chcon -vR ${LABEL} $tmpdir chcon -vR ${LABEL} $tmpdir
ls -Z $tmpdir ls -Z $tmpdir
run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
level=$(secon -l $output)
run ls -dZ ${tmpdir} run ls -dZ ${tmpdir}
is "$output" ${LABEL} "No Relabel Correctly" is "$output" ${LABEL} "No Relabel Correctly"
run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current run_podman run -v $tmpdir:/test:z --security-opt label=disable $IMAGE cat /proc/self/attr/current
level=$(secon -l $output)
run ls -dZ $tmpdir run ls -dZ $tmpdir
is "$output" ${LABEL} "No Privileged Relabel Correctly" is "$output" ${RELABEL} "Privileged Relabel Correctly"
run_podman run -v $tmpdir:/test:z --privileged $IMAGE cat /proc/self/attr/current
run ls -dZ $tmpdir
is "$output" ${RELABEL} "Privileged Relabel Correctly"
run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
level=$(secon -l $output) level=$(secon -l $output)
@ -220,7 +223,7 @@ function check_label() {
run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
run ls -dZ $tmpdir run ls -dZ $tmpdir
is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly" is "$output" ${RELABEL} "Shared Relabel Correctly"
} }
# vim: filetype=sh # vim: filetype=sh