kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

bump opencontainers/selinux to b29023b86e4a69d1b46b7e7b4e2b6fda03f0b9cd

Browse source 
This vendoring fixes two issues.

1. When a user specifies an SELinux MCS Label (level) to override moby picking
   an unigue MCS label, the code currently picks a label then overrides with the
   user selected. This works fine, except the unique MCS Label is leaked and will
   not be used until the daemon is restarted.
2. The override label, is not reserved. This could potentially cause an issue
   where the daemon could pick the same MCS Label again for a different container.
   (~ 1/500,000 Chance).

The updated selinux go bindings, now release the overriden unigue label, and reserve
the one specified by the user.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn 2017-10-31 15:53:11 +01:00
parent 147ec3be2e
commit 73c8238614
No known key found for this signature in database
GPG key ID: 76698F39D527CE8C
3 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
vendor.conf
View file

@ -143,7 +143,7 @@ github.com/Nvveen/Gotty a8b993ba6abdb0e0c12b0125c603323a71c7790c https://github.
# metrics
github.com/docker/go-metrics d466d4f6fd960e01820085bd7e1a24426ee7ef18
github.com/opencontainers/selinux v1.0.0-rc1
github.com/opencontainers/selinux b29023b86e4a69d1b46b7e7b4e2b6fda03f0b9cd
# archive/tar
# mkdir -p ./vendor/archive

2
vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go generated vendored
View file

@ -49,8 +49,10 @@ func InitLabels(options []string) (string, string, error) {
mcon[con[0]] = con[1]
}
}
_ = ReleaseLabel(processLabel)
processLabel = pcon.Get()
mountLabel = mcon.Get()
_ = ReserveLabel(processLabel)
}
return processLabel, mountLabel, nil
}

4
vendor/github.com/opencontainers/selinux/go-selinux/selinux.go generated vendored
View file

@ -213,7 +213,7 @@ func SetFileLabel(path string, label string) error {
return lsetxattr(path, xattrNameSelinux, []byte(label), 0)
}
// Filecon returns the SELinux label for this path or returns an error.
// FileLabel returns the SELinux label for this path or returns an error.
func FileLabel(path string) (string, error) {
label, err := lgetxattr(path, xattrNameSelinux)
if err != nil {
@ -331,7 +331,7 @@ func EnforceMode() int {
}
/*
SetEnforce sets the current SELinux mode Enforcing, Permissive.
SetEnforceMode sets the current SELinux mode Enforcing, Permissive.
Disabled is not valid, since this needs to be set at boot time.
*/
func SetEnforceMode(mode int) error {