From 6831c72f6acd211c34373a0f53f09b61222ce9bd Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Tue, 30 Mar 2021 16:46:52 -0400 Subject: Don't relabel volumes if running in a privileged container Docker does not relabel this content, and openstack is running containers in this manner. There is a penalty for doing this on each container, that is not worth taking on a disable SELinux container. Signed-off-by: Daniel J Walsh --- libpod/container_internal_linux.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'libpod/container_internal_linux.go') diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index d167bf188..4fc45e4f0 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -376,8 +376,14 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) { case "z": fallthrough case "Z": - if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { - return nil, err + if c.MountLabel() != "" { + if c.ProcessLabel() != "" { + if err := label.Relabel(m.Source, c.MountLabel(), label.IsShared(o)); err != nil { + return nil, err + } + } else { + logrus.Infof("Not relabeling volume %q in container %s as SELinux is disabled", m.Source, c.ID()) + } } default: -- cgit v1.2.3-54-g00ecf