diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2019-11-05 21:52:22 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-11-05 21:52:22 +0100 |
| commit | b4b727256c728295e6a3fcb69593347df9e90b23 (patch) | |
| tree | 347305da1e3e0c8141b0f54a6451d8b21ff051fc /pkg | |
| parent | 7eda1b08401ad9ab430261f2b2d236eb9a834454 (diff) | |
| parent | 65ed81993223e96243e0380b34afa40296ea11b3 (diff) | |
| download | podman-b4b727256c728295e6a3fcb69593347df9e90b23.tar.gz podman-b4b727256c728295e6a3fcb69593347df9e90b23.tar.bz2 podman-b4b727256c728295e6a3fcb69593347df9e90b23.zip | |
Merge pull request #4370 from rhatdan/seccomp
Set SELinux labels based on the security context in the kube.yaml
Diffstat (limited to 'pkg')
| -rw-r--r-- | pkg/adapter/pods.go | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/pkg/adapter/pods.go b/pkg/adapter/pods.go index d8d5b884f..f6795970b 100644 --- a/pkg/adapter/pods.go +++ b/pkg/adapter/pods.go @@ -704,6 +704,24 @@ func kubeContainerToCreateConfig(ctx context.Context, containerYAML v1.Container } } + if seopt := containerYAML.SecurityContext.SELinuxOptions; seopt != nil { + if seopt.User != "" { + containerConfig.SecurityOpts = append(containerConfig.SecurityOpts, fmt.Sprintf("label=user:%s", seopt.User)) + containerConfig.LabelOpts = append(containerConfig.LabelOpts, fmt.Sprintf("user:%s", seopt.User)) + } + if seopt.Role != "" { + containerConfig.SecurityOpts = append(containerConfig.SecurityOpts, fmt.Sprintf("label=role:%s", seopt.Role)) + containerConfig.LabelOpts = append(containerConfig.LabelOpts, fmt.Sprintf("role:%s", seopt.Role)) + } + if seopt.Type != "" { + containerConfig.SecurityOpts = append(containerConfig.SecurityOpts, fmt.Sprintf("label=type:%s", seopt.Type)) + containerConfig.LabelOpts = append(containerConfig.LabelOpts, fmt.Sprintf("type:%s", seopt.Type)) + } + if seopt.Level != "" { + containerConfig.SecurityOpts = append(containerConfig.SecurityOpts, fmt.Sprintf("label=level:%s", seopt.Level)) + containerConfig.LabelOpts = append(containerConfig.LabelOpts, fmt.Sprintf("level:%s", seopt.Level)) + } + } if caps := containerYAML.SecurityContext.Capabilities; caps != nil { for _, capability := range caps.Add { containerConfig.CapAdd = append(containerConfig.CapAdd, string(capability)) |