From 4af79a36e283e94cb48442499534f996e27e0f29 Mon Sep 17 00:00:00 2001 From: Tianon Gravi Date: Wed, 12 Mar 2014 01:58:53 -0600 Subject: [PATCH 1/3] Add mention of mounting cgroupfs properly to PACKAGERS.md Docker-DCO-1.1-Signed-off-by: Andrew Page (github: tianon) --- docs/sources/installation/binaries.rst | 6 ++++++ hack/PACKAGERS.md | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/docs/sources/installation/binaries.rst b/docs/sources/installation/binaries.rst index a070599338..ae548e7657 100644 --- a/docs/sources/installation/binaries.rst +++ b/docs/sources/installation/binaries.rst @@ -29,6 +29,12 @@ To run properly, docker needs the following software to be installed at runtime: - iptables version 1.4 or later - Git version 1.7 or later - XZ Utils 4.9 or later +- a `properly mounted + `_ + cgroupfs hierarchy (having a single, all-encompassing "cgroup" mount point `is + `_ `not + `_ `sufficient + `_) Check kernel dependencies diff --git a/hack/PACKAGERS.md b/hack/PACKAGERS.md index dc255c57ad..7170c5ad25 100644 --- a/hack/PACKAGERS.md +++ b/hack/PACKAGERS.md @@ -266,6 +266,12 @@ installed and available at runtime: * iptables version 1.4 or later * XZ Utils version 4.9 or later +* a [properly + mounted](https://github.com/tianon/cgroupfs-mount/blob/master/cgroupfs-mount) + cgroupfs hierarchy (having a single, all-encompassing "cgroup" mount point + [is](https://github.com/dotcloud/docker/issues/2683) + [not](https://github.com/dotcloud/docker/issues/3485) + [sufficient](https://github.com/dotcloud/docker/issues/4568)) Additionally, the Docker client needs the following software to be installed and available at runtime: From f9b8161c60f58d383ca0eaf5a99865b83e4a41b8 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Tue, 1 Apr 2014 09:24:24 -0400 Subject: [PATCH 2/3] Remove hard coding of SELinux labels on systems without proper selinux policy. If a system is configured for SELinux but does not know about docker or containers, then we want the transitions of the policy to work. Hard coding the labels causes docker to break on older Fedora and RHEL systems Docker-DCO-1.1-Signed-off-by: Dan Walsh (github: rhatdan) --- pkg/selinux/selinux.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkg/selinux/selinux.go b/pkg/selinux/selinux.go index 5236d3fb87..6453f37ea9 100644 --- a/pkg/selinux/selinux.go +++ b/pkg/selinux/selinux.go @@ -313,12 +313,9 @@ func GetLxcContexts() (processLabel string, fileLabel string) { return "", "" } lxcPath := fmt.Sprintf("%s/content/lxc_contexts", GetSELinuxPolicyRoot()) - fileLabel = "system_u:object_r:svirt_sandbox_file_t:s0" - processLabel = "system_u:system_r:svirt_lxc_net_t:s0" - in, err := os.Open(lxcPath) if err != nil { - goto exit + return "", "" } defer in.Close() @@ -352,6 +349,11 @@ func GetLxcContexts() (processLabel string, fileLabel string) { } } } + + if processLabel == "" || fileLabel == "" { + return "", "" + } + exit: mcs := IntToMcs(os.Getpid(), 1024) scon := NewContext(processLabel) From 2224e0d65adfbd08e53430a1d7c750491f788257 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Tue, 1 Apr 2014 10:03:29 -0400 Subject: [PATCH 3/3] In certain cases, setting the process label will not happen. When the code attempts to set the ProcessLabel, it checks if SELinux Is enabled. We have seen a case with some of our patches where the code is fooled by the container to think that SELinux is not enabled. Calling label.Init before setting up the rest of the container, tells the library that SELinux is enabled and everything works fine. Docker-DCO-1.1-Signed-off-by: Dan Walsh (github: rhatdan) --- pkg/label/label.go | 3 +++ pkg/label/label_selinux.go | 4 ++++ pkg/libcontainer/nsinit/init.go | 2 ++ 3 files changed, 9 insertions(+) diff --git a/pkg/label/label.go b/pkg/label/label.go index ba1e9f48ea..be0d0ae079 100644 --- a/pkg/label/label.go +++ b/pkg/label/label.go @@ -21,3 +21,6 @@ func SetFileLabel(path string, fileLabel string) error { func GetPidCon(pid int) (string, error) { return "", nil } + +func Init() { +} diff --git a/pkg/label/label_selinux.go b/pkg/label/label_selinux.go index 300a8b6d14..64a1720996 100644 --- a/pkg/label/label_selinux.go +++ b/pkg/label/label_selinux.go @@ -67,3 +67,7 @@ func SetFileLabel(path string, fileLabel string) error { func GetPidCon(pid int) (string, error) { return selinux.Getpidcon(pid) } + +func Init() { + selinux.SelinuxEnabled() +} diff --git a/pkg/libcontainer/nsinit/init.go b/pkg/libcontainer/nsinit/init.go index 5aa5f9f5b5..e5d69f5453 100644 --- a/pkg/libcontainer/nsinit/init.go +++ b/pkg/libcontainer/nsinit/init.go @@ -58,6 +58,8 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol if err := system.ParentDeathSignal(uintptr(syscall.SIGTERM)); err != nil { return fmt.Errorf("parent death signal %s", err) } + + label.Init() ns.logger.Println("setup mount namespace") if err := setupNewMountNamespace(rootfs, container.Mounts, console, container.ReadonlyFs, container.NoPivotRoot, container.Context["mount_label"]); err != nil { return fmt.Errorf("setup mount namespace %s", err)