diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2021-04-05 20:53:14 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-04-05 20:53:14 +0200 |
| commit | ca095e435c6b55ef101b1f2b9653214bd18164f6 (patch) | |
| tree | 7c59a5513e18bb6a70e9c929cda6ac84e5116a9e /libpod | |
| parent | 3fae801a3714ac058c5d19edf7f2288c18e84195 (diff) | |
| parent | 6831c72f6acd211c34373a0f53f09b61222ce9bd (diff) | |
| download | podman-ca095e435c6b55ef101b1f2b9653214bd18164f6.tar.gz podman-ca095e435c6b55ef101b1f2b9653214bd18164f6.tar.bz2 podman-ca095e435c6b55ef101b1f2b9653214bd18164f6.zip | |
Merge pull request #9895 from rhatdan/relabel
Don't relabel volumes if running in a privileged container
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/container_internal_linux.go | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index d167bf188..4fc45e4f0 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -376,8 +376,14 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) { case "z": fallthrough case "Z": - if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { - return nil, err + if c.MountLabel() != "" { + if c.ProcessLabel() != "" { + if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { + return nil, err + } + } else { + logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID()) + } } default: |