diff options
| author | Daniel J Walsh <dwalsh@redhat.com> | 2019-01-18 15:01:53 -0500 |
|---|---|---|
| committer | Matthew Heon <matthew.heon@pm.me> | 2019-02-08 15:02:28 -0500 |
| commit | 14eaca337af0fe3c66624a1a808157b6de8bff68 (patch) | |
| tree | 5f09e9c7578491da839b71351f7ff0b3f205157f /cmd | |
| parent | 2ba7b991b2bae4148eef977136c57f9da828f9bf (diff) | |
| download | podman-14eaca337af0fe3c66624a1a808157b6de8bff68.tar.gz podman-14eaca337af0fe3c66624a1a808157b6de8bff68.tar.bz2 podman-14eaca337af0fe3c66624a1a808157b6de8bff68.zip | |
Vendor in latest opencontainers/selinux
This will now verify labels passed in by the user.
Will also prevent users from accidently relabeling their homedir.
podman run -ti -v ~/home/user:Z fedora sh
Is not a good idea.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'cmd')
| -rw-r--r-- | cmd/podman/create.go | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/cmd/podman/create.go b/cmd/podman/create.go index d98b78bd4..93f38d2db 100644 --- a/cmd/podman/create.go +++ b/cmd/podman/create.go @@ -172,7 +172,11 @@ func parseSecurityOpt(config *cc.CreateConfig, securityOpts []string) error { if err != nil { return errors.Wrapf(err, "container %q not found", config.PidMode.Container()) } - labelOpts = append(labelOpts, label.DupSecOpt(ctr.ProcessLabel())...) + secopts, err := label.DupSecOpt(ctr.ProcessLabel()) + if err != nil { + return errors.Wrapf(err, "failed to duplicate label %q ", ctr.ProcessLabel()) + } + labelOpts = append(labelOpts, secopts...) } if config.IpcMode.IsHost() { @@ -182,7 +186,11 @@ func parseSecurityOpt(config *cc.CreateConfig, securityOpts []string) error { if err != nil { return errors.Wrapf(err, "container %q not found", config.IpcMode.Container()) } - labelOpts = append(labelOpts, label.DupSecOpt(ctr.ProcessLabel())...) + secopts, err := label.DupSecOpt(ctr.ProcessLabel()) + if err != nil { + return errors.Wrapf(err, "failed to duplicate label %q ", ctr.ProcessLabel()) + } + labelOpts = append(labelOpts, secopts...) } for _, opt := range securityOpts { |