summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2019-07-08 20:31:59 +0200
committerGitHub <noreply@github.com>2019-07-08 20:31:59 +0200
commitedc7f52c9577a22f7dcd5b98fbd0125fb8d2da79 (patch)
treee11c01edb0d3d1d6471f27a2efc1b030566223b2 /libpod
parenteae377d6e8875ab19d06189032a7c8f98e5d84dd (diff)
parent95719b6d6b2cf7eae9b60e9a46161a2cbbe588b7 (diff)
downloadpodman-edc7f52c9577a22f7dcd5b98fbd0125fb8d2da79.tar.gz
podman-edc7f52c9577a22f7dcd5b98fbd0125fb8d2da79.tar.bz2
podman-edc7f52c9577a22f7dcd5b98fbd0125fb8d2da79.zip
Merge pull request #3425 from adrianreber/restore-mount-label
Set correct SELinux label on restored containers
Diffstat (limited to 'libpod')
-rw-r--r--libpod/container.go3
-rw-r--r--libpod/container_internal.go10
-rw-r--r--libpod/runtime_ctr.go9
3 files changed, 18 insertions, 4 deletions
diff --git a/libpod/container.go b/libpod/container.go
index bfbc47d76..a9b512de9 100644
--- a/libpod/container.go
+++ b/libpod/container.go
@@ -138,6 +138,9 @@ type Container struct {
// being checkpointed. If requestedIP is set it will be used instead
// of config.StaticIP.
requestedIP net.IP
+
+ // This is true if a container is restored from a checkpoint.
+ restoreFromCheckpoint bool
}
// ContainerState contains the current state of the container
diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index 1cac7b003..c409da96a 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -352,6 +352,16 @@ func (c *Container) setupStorage(ctx context.Context) error {
},
LabelOpts: c.config.LabelOpts,
}
+ if c.restoreFromCheckpoint {
+ // If restoring from a checkpoint, the root file-system
+ // needs to be mounted with the same SELinux labels as
+ // it was mounted previously.
+ if options.Flags == nil {
+ options.Flags = make(map[string]interface{})
+ }
+ options.Flags["ProcessLabel"] = c.config.ProcessLabel
+ options.Flags["MountLabel"] = c.config.MountLabel
+ }
if c.config.Privileged {
privOpt := func(opt string) bool {
for _, privopt := range []string{"nodev", "nosuid", "noexec"} {
diff --git a/libpod/runtime_ctr.go b/libpod/runtime_ctr.go
index d022478b1..633d26fe1 100644
--- a/libpod/runtime_ctr.go
+++ b/libpod/runtime_ctr.go
@@ -52,7 +52,7 @@ func (r *Runtime) RestoreContainer(ctx context.Context, rSpec *spec.Spec, config
if err != nil {
return nil, errors.Wrapf(err, "error initializing container variables")
}
- return r.setupContainer(ctx, ctr, true)
+ return r.setupContainer(ctx, ctr)
}
func (r *Runtime) initContainerVariables(rSpec *spec.Spec, config *ContainerConfig) (c *Container, err error) {
@@ -68,6 +68,7 @@ func (r *Runtime) initContainerVariables(rSpec *spec.Spec, config *ContainerConf
ctr.config.ShmSize = DefaultShmSize
} else {
// This is a restore from an imported checkpoint
+ ctr.restoreFromCheckpoint = true
if err := JSONDeepCopy(config, ctr.config); err != nil {
return nil, errors.Wrapf(err, "error copying container config for restore")
}
@@ -119,10 +120,10 @@ func (r *Runtime) newContainer(ctx context.Context, rSpec *spec.Spec, options ..
return nil, errors.Wrapf(err, "error running container create option")
}
}
- return r.setupContainer(ctx, ctr, false)
+ return r.setupContainer(ctx, ctr)
}
-func (r *Runtime) setupContainer(ctx context.Context, ctr *Container, restore bool) (c *Container, err error) {
+func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (c *Container, err error) {
// Allocate a lock for the container
lock, err := r.lockManager.AllocateLock()
if err != nil {
@@ -211,7 +212,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container, restore bo
return nil, errors.Wrapf(config2.ErrInvalidArg, "unsupported CGroup manager: %s - cannot validate cgroup parent", r.config.CgroupManager)
}
- if restore {
+ if ctr.restoreFromCheckpoint {
// Remove information about bind mount
// for new container from imported checkpoint
g := generate.Generator{Config: ctr.config.Spec}