diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2020-12-08 12:19:26 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-12-08 12:19:26 -0500 |
| commit | 3bf02fb00a6ef23a55f818198107cf468b45ccf5 (patch) | |
| tree | 045409be8977c91789074ab90f6a3bb7bfae218e /cmd/podman/common/specgen.go | |
| parent | 0cccba834ff2939579f7ef4c340a9337dc9d7d2c (diff) | |
| parent | 239bd57662162e9754421a31db9cf529cee8d701 (diff) | |
| download | podman-3bf02fb00a6ef23a55f818198107cf468b45ccf5.tar.gz podman-3bf02fb00a6ef23a55f818198107cf468b45ccf5.tar.bz2 podman-3bf02fb00a6ef23a55f818198107cf468b45ccf5.zip | |
Merge pull request #8630 from umohnani8/sec-opt
Add systempaths=unconfined option
Diffstat (limited to 'cmd/podman/common/specgen.go')
| -rw-r--r-- | cmd/podman/common/specgen.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/cmd/podman/common/specgen.go b/cmd/podman/common/specgen.go index e0da142ad..c416d0d7b 100644 --- a/cmd/podman/common/specgen.go +++ b/cmd/podman/common/specgen.go @@ -531,6 +531,13 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string case "seccomp": s.SeccompProfilePath = con[1] s.Annotations[define.InspectAnnotationSeccomp] = con[1] + // this option is for docker compatibility, it is the same as unmask=ALL + case "systempaths": + if con[1] == "unconfined" { + s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, []string{"ALL"}...) + } else { + return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", con[1]) + } case "unmask": s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, strings.Split(con[1], ":")...) default: |