diff options
| author | Peter Hunt <pehunt@redhat.com> | 2019-03-07 12:52:54 -0500 |
|---|---|---|
| committer | Peter Hunt <pehunt@redhat.com> | 2019-03-28 09:54:31 -0400 |
| commit | 0d0ad59641a308450d694d4c2fb95303c64fabf8 (patch) | |
| tree | cce1ff87f1c9c501b70ee360fceacb512808e5bd /libpod/runtime_volume_linux.go | |
| parent | 850326cc192444d1c5cfd8ba6e1015f653b41e73 (diff) | |
| download | podman-0d0ad59641a308450d694d4c2fb95303c64fabf8.tar.gz podman-0d0ad59641a308450d694d4c2fb95303c64fabf8.tar.bz2 podman-0d0ad59641a308450d694d4c2fb95303c64fabf8.zip | |
Default to SELinux private label for play kube mounts
Before, there were SELinux denials when a volume was bind-mounted by podman play kube.
Partially fix this by setting the default private label for mounts created by play kube (with DirectoryOrCreate)
For volumes mounted as Directory, the user will have to set their own SELinux permissions on the mount point
also remove left over debugging print statement
Signed-off-by: Peter Hunt <pehunt@redhat.com>
Diffstat (limited to 'libpod/runtime_volume_linux.go')
| -rw-r--r-- | libpod/runtime_volume_linux.go | 12 |
1 files changed, 2 insertions, 10 deletions
diff --git a/libpod/runtime_volume_linux.go b/libpod/runtime_volume_linux.go index b51bb8213..5767a99e7 100644 --- a/libpod/runtime_volume_linux.go +++ b/libpod/runtime_volume_linux.go @@ -10,7 +10,6 @@ import ( "github.com/containers/libpod/libpod/events" "github.com/containers/storage/pkg/stringid" - "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" "github.com/sirupsen/logrus" ) @@ -56,15 +55,8 @@ func (r *Runtime) newVolume(ctx context.Context, options ...VolumeCreateOption) if err := os.MkdirAll(fullVolPath, 0755); err != nil { return nil, errors.Wrapf(err, "error creating volume directory %q", fullVolPath) } - _, mountLabel, err := label.InitLabels([]string{}) - if err != nil { - return nil, errors.Wrapf(err, "error getting default mountlabels") - } - if err := label.ReleaseLabel(mountLabel); err != nil { - return nil, errors.Wrapf(err, "error releasing label %q", mountLabel) - } - if err := label.Relabel(fullVolPath, mountLabel, true); err != nil { - return nil, errors.Wrapf(err, "error setting selinux label to %q", fullVolPath) + if err := LabelVolumePath(fullVolPath, true); err != nil { + return nil, err } volume.config.MountPoint = fullVolPath |