summaryrefslogtreecommitdiff
path: root/vendor/github.com/opencontainers/selinux/go-selinux/label
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2019-08-09 16:29:43 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2019-08-13 10:16:01 -0400
commit316e51f0a91d24f75a9191e2226928bc0c1c5b91 (patch)
tree7ab971c3fe4a1eedb291f89e9777dfb77ca90afe /vendor/github.com/opencontainers/selinux/go-selinux/label
parentc48243ee1eb3fe36b54057994d5e908d8a3d7f16 (diff)
downloadpodman-316e51f0a91d24f75a9191e2226928bc0c1c5b91.tar.gz
podman-316e51f0a91d24f75a9191e2226928bc0c1c5b91.tar.bz2
podman-316e51f0a91d24f75a9191e2226928bc0c1c5b91.zip
Add support & documentation to run containers with different file types
Udica is adding new features to allow users to define container process and file types. This would allow us to setup trusted communications channels between multiple security domains. ContainerA -> ContainerB -> ContainerC Add tests to make sure users can change file types Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'vendor/github.com/opencontainers/selinux/go-selinux/label')
-rw-r--r--vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go18
1 files changed, 11 insertions, 7 deletions
diff --git a/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go b/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
index 1eb9a6bf2..2730fcf4a 100644
--- a/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
+++ b/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
@@ -13,11 +13,12 @@ import (
// Valid Label Options
var validOptions = map[string]bool{
- "disable": true,
- "type": true,
- "user": true,
- "role": true,
- "level": true,
+ "disable": true,
+ "type": true,
+ "filetype": true,
+ "user": true,
+ "role": true,
+ "level": true,
}
var ErrIncompatibleLabel = fmt.Errorf("Bad SELinux option z and Z can not be used together")
@@ -51,13 +52,16 @@ func InitLabels(options []string) (plabel string, mlabel string, Err error) {
return "", mountLabel, nil
}
if i := strings.Index(opt, ":"); i == -1 {
- return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt)
+ return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
}
con := strings.SplitN(opt, ":", 2)
if !validOptions[con[0]] {
- return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0])
+ return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type, filetype'", con[0])
}
+ if con[0] == "filetype" {
+ mcon["type"] = con[1]
+ }
pcon[con[0]] = con[1]
if con[0] == "level" || con[0] == "user" {
mcon[con[0]] = con[1]