diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2020-10-05 10:32:28 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-10-05 10:32:28 +0200 |
| commit | 7353000a06f3636515ebcd3b79ca8309db48b693 (patch) | |
| tree | 0144357de85b0e2c59a3d6529268477421156200 /pkg/specgen/generate/container_create.go | |
| parent | 7c12967257742063206c05f0baec517bc08cbeb6 (diff) | |
| parent | d0f3c17912643aca73372aa87f3eadf757621ccc (diff) | |
| download | podman-7353000a06f3636515ebcd3b79ca8309db48b693.tar.gz podman-7353000a06f3636515ebcd3b79ca8309db48b693.tar.bz2 podman-7353000a06f3636515ebcd3b79ca8309db48b693.zip | |
Merge pull request #7902 from rhatdan/selinux
Add SELinux support for pods
Diffstat (limited to 'pkg/specgen/generate/container_create.go')
| -rw-r--r-- | pkg/specgen/generate/container_create.go | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go index 2ac3b376f..147450703 100644 --- a/pkg/specgen/generate/container_create.go +++ b/pkg/specgen/generate/container_create.go @@ -11,6 +11,7 @@ import ( "github.com/containers/podman/v2/pkg/specgen" "github.com/containers/podman/v2/pkg/util" "github.com/containers/storage" + "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" "github.com/sirupsen/logrus" ) @@ -272,6 +273,21 @@ func createContainerOptions(ctx context.Context, rt *libpod.Runtime, s *specgen. // Security options if len(s.SelinuxOpts) > 0 { options = append(options, libpod.WithSecLabels(s.SelinuxOpts)) + } else { + if pod != nil { + // duplicate the security options from the pod + processLabel, err := pod.ProcessLabel() + if err != nil { + return nil, err + } + if processLabel != "" { + selinuxOpts, err := label.DupSecOpt(processLabel) + if err != nil { + return nil, err + } + options = append(options, libpod.WithSecLabels(selinuxOpts)) + } + } } options = append(options, libpod.WithPrivileged(s.Privileged)) |