diff options
author | Daniel J Walsh <dwalsh@redhat.com> | 2018-10-18 14:48:41 -0400 |
---|---|---|
committer | Daniel J Walsh <dwalsh@redhat.com> | 2018-10-23 10:32:32 -0400 |
commit | 57b0b89d0ceb77bfd51a4d957f51fcea3d1580f6 (patch) | |
tree | c29cf5a145ff7acb05f2a656f821420740c6a2a4 /vendor/github.com/opencontainers/selinux/go-selinux/label | |
parent | 9a6a64f78ca3837a0e02373b2ae7f3769fbde568 (diff) | |
download | podman-57b0b89d0ceb77bfd51a4d957f51fcea3d1580f6.tar.gz podman-57b0b89d0ceb77bfd51a4d957f51fcea3d1580f6.tar.bz2 podman-57b0b89d0ceb77bfd51a4d957f51fcea3d1580f6.zip |
Vendor in latest containers/storage opencontainers/selinux
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'vendor/github.com/opencontainers/selinux/go-selinux/label')
-rw-r--r-- | vendor/github.com/opencontainers/selinux/go-selinux/label/label.go | 5 | ||||
-rw-r--r-- | vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go | 14 |
2 files changed, 17 insertions, 2 deletions
diff --git a/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go b/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go index 6cfc5fded..2a31cd3c5 100644 --- a/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go +++ b/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go @@ -48,6 +48,11 @@ func GetPidLabel(pid int) (string, error) { func Init() { } +// ClearLabels clears all reserved labels +func ClearLabels() { + return +} + func ReserveLabel(label string) error { return nil } diff --git a/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go b/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go index f0a055b87..63c4edd05 100644 --- a/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go +++ b/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go @@ -24,17 +24,22 @@ var ErrIncompatibleLabel = fmt.Errorf("Bad SELinux option z and Z can not be use // the container. A list of options can be passed into this function to alter // the labels. The labels returned will include a random MCS String, that is // guaranteed to be unique. -func InitLabels(options []string) (string, string, error) { +func InitLabels(options []string) (plabel string, mlabel string, Err error) { if !selinux.GetEnabled() { return "", "", nil } processLabel, mountLabel := selinux.ContainerLabels() if processLabel != "" { + defer func() { + if Err != nil { + ReleaseLabel(mountLabel) + } + }() pcon := selinux.NewContext(processLabel) mcon := selinux.NewContext(mountLabel) for _, opt := range options { if opt == "disable" { - return "", "", nil + return "", mountLabel, nil } if i := strings.Index(opt, ":"); i == -1 { return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt) @@ -156,6 +161,11 @@ func Init() { selinux.GetEnabled() } +// ClearLabels will clear all reserved labels +func ClearLabels() { + selinux.ClearLabels() +} + // ReserveLabel will record the fact that the MCS label has already been used. // This will prevent InitLabels from using the MCS label in a newly created // container |