summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2021-03-30 16:46:52 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2021-04-05 13:07:36 -0400
commit6831c72f6acd211c34373a0f53f09b61222ce9bd (patch)
tree7c59a5513e18bb6a70e9c929cda6ac84e5116a9e
parent3fae801a3714ac058c5d19edf7f2288c18e84195 (diff)
downloadpodman-6831c72f6acd211c34373a0f53f09b61222ce9bd.tar.gz
podman-6831c72f6acd211c34373a0f53f09b61222ce9bd.tar.bz2
podman-6831c72f6acd211c34373a0f53f09b61222ce9bd.zip
Don't relabel volumes if running in a privileged container
Docker does not relabel this content, and openstack is running containers in this manner. There is a penalty for doing this on each container, that is not worth taking on a disable SELinux container. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
-rw-r--r--libpod/container_internal_linux.go10
-rw-r--r--test/system/410-selinux.bats28
2 files changed, 36 insertions, 2 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index d167bf188..4fc45e4f0 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -376,8 +376,14 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
case "z":
fallthrough
case "Z":
- if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
- return nil, err
+ if c.MountLabel() != "" {
+ if c.ProcessLabel() != "" {
+ if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
+ return nil, err
+ }
+ } else {
+ logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID())
+ }
}
default:
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 4a2c7b7a4..8a690fb48 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -191,5 +191,33 @@ function check_label() {
is "$output" "Error.*: \`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" "useful diagnostic"
}
+@test "podman selinux: check relabel" {
+ skip_if_no_selinux
+
+ LABEL="system_u:object_r:tmp_t:s0"
+ tmpdir=$PODMAN_TMPDIR/vol
+ touch $tmpdir
+ chcon -vR ${LABEL} $tmpdir
+ ls -Z $tmpdir
+
+ run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
+ level=$(secon -l $output)
+ run ls -dZ ${tmpdir}
+ is "$output" ${LABEL} "No Relabel Correctly"
+
+ run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current
+ level=$(secon -l $output)
+ run ls -dZ $tmpdir
+ is "$output" ${LABEL} "No Privileged Relabel Correctly"
+
+ run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
+ level=$(secon -l $output)
+ run ls -dZ $tmpdir
+ is "$output" "system_u:object_r:container_file_t:$level" "Confined Relabel Correctly"
+
+ run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
+ run ls -dZ $tmpdir
+ is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly"
+}
# vim: filetype=sh