summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2021-05-06 17:41:04 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2021-05-06 18:00:16 -0400
commitf528511bf6c7630408dc630d05197a49d39479c4 (patch)
treeeeb081a3cb376005fe4691c78acbd43a92dc2692 /libpod
parent034470e5be8cfeef8ce0e0d2f47587a660682219 (diff)
downloadpodman-f528511bf6c7630408dc630d05197a49d39479c4.tar.gz
podman-f528511bf6c7630408dc630d05197a49d39479c4.tar.bz2
podman-f528511bf6c7630408dc630d05197a49d39479c4.zip
Revert Patch to relabel if selinux not enabled
Revert : https://github.com/containers/podman/pull/9895 Turns out that if Docker is in --selinux-enabeled, it still relabels if the user tells the system to, even if running a --privileged container or if the selinux separation is disabled --security-opt label=disable. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'libpod')
-rw-r--r--libpod/container_internal_linux.go10
1 files changed, 2 insertions, 8 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index f0608e2b2..14816f6aa 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -377,14 +377,8 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
case "z":
fallthrough
case "Z":
- if c.MountLabel() != "" {
- if c.ProcessLabel() != "" {
- if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
- return nil, err
- }
- } else {
- logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID())
- }
+ if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil {
+ return nil, err
}
default: