diff options
| author | Daniel J Walsh <dwalsh@redhat.com> | 2020-04-15 14:48:53 -0400 |
|---|---|---|
| committer | Daniel J Walsh <dwalsh@redhat.com> | 2020-04-15 16:52:16 -0400 |
| commit | c4ca3c71ffe3c08bc74158340b3427d00efdfe32 (patch) | |
| tree | 46a81877ca430ebf3f2161f6b582773fd3dd869d /libpod/container_internal.go | |
| parent | 195cb11276d61311bbd2b5274ac7a98b62abaaba (diff) | |
| download | podman-c4ca3c71ffe3c08bc74158340b3427d00efdfe32.tar.gz podman-c4ca3c71ffe3c08bc74158340b3427d00efdfe32.tar.bz2 podman-c4ca3c71ffe3c08bc74158340b3427d00efdfe32.zip | |
Add support for selecting kvm and systemd labels
In order to better support kata containers and systemd containers
container-selinux has added new types. Podman should execute the
container with an SELinux process label to match the container type.
Traditional Container process : container_t
KVM Container Process: containre_kvm_t
PID 1 Init process: container_init_t
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'libpod/container_internal.go')
| -rw-r--r-- | libpod/container_internal.go | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/libpod/container_internal.go b/libpod/container_internal.go index c930017a4..50bd9bc25 100644 --- a/libpod/container_internal.go +++ b/libpod/container_internal.go @@ -19,6 +19,7 @@ import ( "github.com/containers/libpod/pkg/hooks" "github.com/containers/libpod/pkg/hooks/exec" "github.com/containers/libpod/pkg/rootless" + "github.com/containers/libpod/pkg/util" "github.com/containers/storage" "github.com/containers/storage/pkg/archive" "github.com/containers/storage/pkg/mount" @@ -430,7 +431,22 @@ func (c *Container) setupStorage(ctx context.Context) error { c.config.IDMappings.UIDMap = containerInfo.UIDMap c.config.IDMappings.GIDMap = containerInfo.GIDMap - c.config.ProcessLabel = containerInfo.ProcessLabel + + processLabel := containerInfo.ProcessLabel + switch { + case c.ociRuntime.SupportsKVM(): + processLabel, err = util.SELinuxKVMLabel(processLabel) + if err != nil { + return err + } + case c.config.Systemd: + processLabel, err = util.SELinuxInitLabel(processLabel) + if err != nil { + return err + } + } + + c.config.ProcessLabel = processLabel c.config.MountLabel = containerInfo.MountLabel c.config.StaticDir = containerInfo.Dir c.state.RunDir = containerInfo.RunDir |