summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
Diffstat (limited to 'libpod')
-rw-r--r--libpod/oci.go44
1 files changed, 27 insertions, 17 deletions
diff --git a/libpod/oci.go b/libpod/oci.go
index b5b5fd81e..725819b54 100644
--- a/libpod/oci.go
+++ b/libpod/oci.go
@@ -284,22 +284,6 @@ func (r *OCIRuntime) createOCIContainer(ctr *Container, cgroupParent string) (er
"args": args,
}).Debugf("running conmon: %s", r.conmonPath)
- if selinux.GetEnabled() {
- // Set the label of the conmon process to be level :s0
- // This will allow the container processes to talk to fifo-files
- // passed into the container by conmon
- plabel, err := selinux.CurrentLabel()
- if err != nil {
- return errors.Wrapf(err, "Failed to get current SELinux label")
- }
-
- c := selinux.NewContext(plabel)
- if c["level"] != "s0" && c["level"] != "" {
- c["level"] = "s0"
- label.SetProcessLabel(c.Get())
- }
- }
-
cmd := exec.Command(r.conmonPath, args...)
cmd.Dir = ctr.bundlePath()
cmd.SysProcAttr = &syscall.SysProcAttr{
@@ -327,7 +311,33 @@ func (r *OCIRuntime) createOCIContainer(ctr *Container, cgroupParent string) (er
cmd.ExtraFiles = append(cmd.ExtraFiles, fds...)
}
- err = cmd.Start()
+ if selinux.GetEnabled() {
+ // Set the label of the conmon process to be level :s0
+ // This will allow the container processes to talk to fifo-files
+ // passed into the container by conmon
+ plabel, err := selinux.CurrentLabel()
+ if err != nil {
+ childPipe.Close()
+ return errors.Wrapf(err, "Failed to get current SELinux label")
+ }
+
+ c := selinux.NewContext(plabel)
+ runtime.LockOSThread()
+ if c["level"] != "s0" && c["level"] != "" {
+ c["level"] = "s0"
+ if err := label.SetProcessLabel(c.Get()); err != nil {
+ runtime.UnlockOSThread()
+ return err
+ }
+ }
+ err = cmd.Start()
+ // Ignore error returned from SetProcessLabel("") call,
+ // can't recover.
+ label.SetProcessLabel("")
+ runtime.UnlockOSThread()
+ } else {
+ err = cmd.Start()
+ }
if err != nil {
childPipe.Close()
return err