diff options
| author | Daniel J Walsh <dwalsh@redhat.com> | 2021-03-30 16:46:52 -0400 |
|---|---|---|
| committer | Daniel J Walsh <dwalsh@redhat.com> | 2021-04-05 13:07:36 -0400 |
| commit | 6831c72f6acd211c34373a0f53f09b61222ce9bd (patch) | |
| tree | 7c59a5513e18bb6a70e9c929cda6ac84e5116a9e /libpod | |
| parent | 3fae801a3714ac058c5d19edf7f2288c18e84195 (diff) | |
| download | podman-6831c72f6acd211c34373a0f53f09b61222ce9bd.tar.gz podman-6831c72f6acd211c34373a0f53f09b61222ce9bd.tar.bz2 podman-6831c72f6acd211c34373a0f53f09b61222ce9bd.zip | |
Don't relabel volumes if running in a privileged container
Docker does not relabel this content, and openstack is running
containers in this manner. There is a penalty for doing this
on each container, that is not worth taking on a disable SELinux
container.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/container_internal_linux.go | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index d167bf188..4fc45e4f0 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -376,8 +376,14 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) { case "z": fallthrough case "Z": - if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { - return nil, err + if c.MountLabel() != "" { + if c.ProcessLabel() != "" { + if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { + return nil, err + } + } else { + logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID()) + } } default: |