aboutsummaryrefslogtreecommitdiff
path: root/libpod/oci.go
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2019-01-21 08:49:20 +0100
committerGitHub <noreply@github.com>2019-01-21 08:49:20 +0100
commit4afdfd5eab4d887bf023b39f7b179e422b33a6d5 (patch)
tree788fec7b3b967a33cea0eaef3aec1235aceca5df /libpod/oci.go
parentef2f6f9f3ee3a54ffc3b9cd0740230b60dcc8d6a (diff)
parent8cf929c0950e985880b268ae4c8ad08d98bc4073 (diff)
downloadpodman-4afdfd5eab4d887bf023b39f7b179e422b33a6d5.tar.gz
podman-4afdfd5eab4d887bf023b39f7b179e422b33a6d5.tar.bz2
podman-4afdfd5eab4d887bf023b39f7b179e422b33a6d5.zip
Merge pull request #2187 from rhatdan/selinux
Vendor in latest opencontainers/selinux
Diffstat (limited to 'libpod/oci.go')
-rw-r--r--libpod/oci.go17
1 files changed, 12 insertions, 5 deletions
diff --git a/libpod/oci.go b/libpod/oci.go
index 3451ddaa8..e55bd57dc 100644
--- a/libpod/oci.go
+++ b/libpod/oci.go
@@ -356,18 +356,25 @@ func (r *OCIRuntime) createOCIContainer(ctr *Container, cgroupParent string, res
// Set the label of the conmon process to be level :s0
// This will allow the container processes to talk to fifo-files
// passed into the container by conmon
- var plabel string
+ var (
+ plabel string
+ con selinux.Context
+ )
plabel, err = selinux.CurrentLabel()
if err != nil {
childPipe.Close()
return errors.Wrapf(err, "Failed to get current SELinux label")
}
- c := selinux.NewContext(plabel)
+ con, err = selinux.NewContext(plabel)
+ if err != nil {
+ return errors.Wrapf(err, "Failed to get new context from SELinux label")
+ }
+
runtime.LockOSThread()
- if c["level"] != "s0" && c["level"] != "" {
- c["level"] = "s0"
- if err = label.SetProcessLabel(c.Get()); err != nil {
+ if con["level"] != "s0" && con["level"] != "" {
+ con["level"] = "s0"
+ if err = label.SetProcessLabel(con.Get()); err != nil {
runtime.UnlockOSThread()
return err
}