diff options
| author | Daniel J Walsh <dwalsh@redhat.com> | 2021-03-30 16:46:52 -0400 |
|---|---|---|
| committer | Matthew Heon <mheon@redhat.com> | 2021-04-16 13:13:06 -0400 |
| commit | 179f02621554e08005df005c162eba482f808c60 (patch) | |
| tree | 5f5fb7bb37f16621275e2c162ae5a9b157fc308e /libpod/container_internal_linux.go | |
| parent | b3ef9e4dd8f91326b1f5e85360679ec5ffd213f9 (diff) | |
| download | podman-179f02621554e08005df005c162eba482f808c60.tar.gz podman-179f02621554e08005df005c162eba482f808c60.tar.bz2 podman-179f02621554e08005df005c162eba482f808c60.zip | |
Don't relabel volumes if running in a privileged container
Docker does not relabel this content, and openstack is running
containers in this manner. There is a penalty for doing this
on each container, that is not worth taking on a disable SELinux
container.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'libpod/container_internal_linux.go')
| -rw-r--r-- | libpod/container_internal_linux.go | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index 0669f4db5..1990ac776 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -380,8 +380,14 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) { case "z": fallthrough case "Z": - if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { - return nil, err + if c.MountLabel() != "" { + if c.ProcessLabel() != "" { + if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { + return nil, err + } + } else { + logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID()) + } } default: |