diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2019-03-11 12:59:46 -0700 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-03-11 12:59:46 -0700 |
| commit | 1466c8a2f8020c5cc1541348f5f6533239f94136 (patch) | |
| tree | e9d1f0825c5f24b92fc9578b172ca9f63da468cf | |
| parent | 7038cac53c4c93cd088fdbb097eee8d45494c3b8 (diff) | |
| parent | de12f4568864458c776cbf4aa8788ca46a576ac4 (diff) | |
| download | podman-1466c8a2f8020c5cc1541348f5f6533239f94136.tar.gz podman-1466c8a2f8020c5cc1541348f5f6533239f94136.tar.bz2 podman-1466c8a2f8020c5cc1541348f5f6533239f94136.zip | |
Merge pull request #2613 from rhatdan/selinux
Fix SELinux on host shared systems in userns
| -rw-r--r-- | pkg/spec/spec.go | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go index 28a636fa6..32d47732b 100644 --- a/pkg/spec/spec.go +++ b/pkg/spec/spec.go @@ -454,10 +454,6 @@ func findMount(target string, mounts []*pmount.Info) (*pmount.Info, error) { } func blockAccessToKernelFilesystems(config *CreateConfig, g *generate.Generator) { - if config.PidMode.IsHost() && rootless.IsRootless() { - return - } - if !config.Privileged { for _, mp := range []string{ "/proc/acpi", @@ -469,10 +465,15 @@ func blockAccessToKernelFilesystems(config *CreateConfig, g *generate.Generator) "/proc/sched_debug", "/proc/scsi", "/sys/firmware", + "/sys/fs/selinux", } { g.AddLinuxMaskedPaths(mp) } + if config.PidMode.IsHost() && rootless.IsRootless() { + return + } + for _, rp := range []string{ "/proc/asound", "/proc/bus", |