summaryrefslogtreecommitdiff
path: root/pkg/util
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2020-04-16 05:29:19 -0700
committerGitHub <noreply@github.com>2020-04-16 05:29:19 -0700
commit09e821a8eae603174c809bcc4af641d4ed5dc35c (patch)
tree6f2d4a5361cca06dce3b902ce7c71336f1cbf7d1 /pkg/util
parent084cfb81da4f3f3e06ad35bfb3ea52027f62273b (diff)
parentc4ca3c71ffe3c08bc74158340b3427d00efdfe32 (diff)
downloadpodman-09e821a8eae603174c809bcc4af641d4ed5dc35c.tar.gz
podman-09e821a8eae603174c809bcc4af641d4ed5dc35c.tar.bz2
podman-09e821a8eae603174c809bcc4af641d4ed5dc35c.zip
Merge pull request #5690 from rhatdan/selinux
Add support for selecting kvm and systemd labels
Diffstat (limited to 'pkg/util')
-rw-r--r--pkg/util/utils.go36
1 files changed, 36 insertions, 0 deletions
diff --git a/pkg/util/utils.go b/pkg/util/utils.go
index 3906ed19f..babf7dfc9 100644
--- a/pkg/util/utils.go
+++ b/pkg/util/utils.go
@@ -21,6 +21,7 @@ import (
"github.com/containers/storage"
"github.com/containers/storage/pkg/idtools"
v1 "github.com/opencontainers/image-spec/specs-go/v1"
+ "github.com/opencontainers/selinux/go-selinux"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"golang.org/x/crypto/ssh/terminal"
@@ -633,3 +634,38 @@ func ValidateSysctls(strSlice []string) (map[string]string, error) {
}
return sysctl, nil
}
+
+// SELinuxKVMLabel returns labels for running kvm isolated containers
+func SELinuxKVMLabel(cLabel string) (string, error) {
+ if cLabel == "" {
+ // selinux is disabled
+ return "", nil
+ }
+ processLabel, _ := selinux.KVMContainerLabels()
+ selinux.ReleaseLabel(processLabel)
+ return swapSELinuxLabel(cLabel, processLabel)
+}
+
+// SELinuxInitLabel returns labels for running systemd based containers
+func SELinuxInitLabel(cLabel string) (string, error) {
+ if cLabel == "" {
+ // selinux is disabled
+ return "", nil
+ }
+ processLabel, _ := selinux.InitContainerLabels()
+ selinux.ReleaseLabel(processLabel)
+ return swapSELinuxLabel(cLabel, processLabel)
+}
+
+func swapSELinuxLabel(cLabel, processLabel string) (string, error) {
+ dcon, err := selinux.NewContext(cLabel)
+ if err != nil {
+ return "", err
+ }
+ scon, err := selinux.NewContext(processLabel)
+ if err != nil {
+ return "", err
+ }
+ dcon["type"] = scon["type"]
+ return dcon.Get(), nil
+}