From abbbf914986d6d0ea15923f9a57a99465791bc83 Mon Sep 17 00:00:00 2001 From: Antonio Murdaca Date: Tue, 18 Apr 2017 15:26:36 +0200 Subject: [PATCH] Switch to using opencontainers/selinux for selinux bindings Signed-off-by: Antonio Murdaca --- container/container.go | 2 +- container/container_unix.go | 2 +- daemon/container_operations_unix.go | 2 +- daemon/create.go | 17 +- daemon/create_unix.go | 2 +- daemon/daemon_solaris.go | 2 +- daemon/daemon_unix.go | 2 +- daemon/graphdriver/aufs/aufs.go | 2 +- daemon/graphdriver/btrfs/btrfs.go | 2 +- daemon/graphdriver/devmapper/deviceset.go | 2 +- daemon/graphdriver/overlay/overlay.go | 2 +- daemon/graphdriver/overlay2/overlay.go | 2 +- daemon/graphdriver/vfs/driver.go | 2 +- daemon/graphdriver/zfs/zfs.go | 2 +- daemon/selinux_linux.go | 6 +- vendor.conf | 1 + .../github.com/opencontainers/selinux/LICENSE | 201 +++++++++++++ .../opencontainers/selinux/README.md | 7 + .../go-selinux}/label/label.go | 2 +- .../go-selinux}/label/label_selinux.go | 48 ++-- .../selinux => selinux/go-selinux}/selinux.go | 266 ++++++++++++------ .../selinux/go-selinux/xattrs.go | 78 +++++ volume/volume.go | 2 +- 23 files changed, 515 insertions(+), 139 deletions(-) create mode 100644 vendor/github.com/opencontainers/selinux/LICENSE create mode 100644 vendor/github.com/opencontainers/selinux/README.md rename vendor/github.com/opencontainers/{runc/libcontainer => selinux/go-selinux}/label/label.go (97%) rename vendor/github.com/opencontainers/{runc/libcontainer => selinux/go-selinux}/label/label_selinux.go (82%) rename vendor/github.com/opencontainers/{runc/libcontainer/selinux => selinux/go-selinux}/selinux.go (60%) create mode 100644 vendor/github.com/opencontainers/selinux/go-selinux/xattrs.go diff --git a/container/container.go b/container/container.go index 98173f4321..16cdbf0f1c 100644 --- a/container/container.go +++ b/container/container.go @@ -43,7 +43,7 @@ import ( "github.com/docker/libnetwork/options" "github.com/docker/libnetwork/types" agentexec "github.com/docker/swarmkit/agent/exec" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) const configFileName = "config.v2.json" diff --git a/container/container_unix.go b/container/container_unix.go index bd497a9260..898a1bdceb 100644 --- a/container/container_unix.go +++ b/container/container_unix.go @@ -17,7 +17,7 @@ import ( "github.com/docker/docker/pkg/symlink" "github.com/docker/docker/pkg/system" "github.com/docker/docker/volume" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" "golang.org/x/sys/unix" ) diff --git a/daemon/container_operations_unix.go b/daemon/container_operations_unix.go index 17d5a061dd..0b602ef20c 100644 --- a/daemon/container_operations_unix.go +++ b/daemon/container_operations_unix.go @@ -19,7 +19,7 @@ import ( "github.com/docker/docker/pkg/stringid" "github.com/docker/docker/runconfig" "github.com/docker/libnetwork" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" ) diff --git a/daemon/create.go b/daemon/create.go index 55a106c646..b9c54a72b6 100644 --- a/daemon/create.go +++ b/daemon/create.go @@ -20,7 +20,7 @@ import ( "github.com/docker/docker/pkg/idtools" "github.com/docker/docker/pkg/stringid" "github.com/docker/docker/runconfig" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) // CreateManagedContainer creates a container that is managed by a Service @@ -155,6 +155,13 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) ( return container, nil } +func toHostConfigSelinuxLabels(labels []string) []string { + for i, l := range labels { + labels[i] = "label=" + l + } + return labels +} + func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig) ([]string, error) { for _, opt := range hostConfig.SecurityOpt { con := strings.Split(opt, "=") @@ -167,7 +174,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig) pidMode := hostConfig.PidMode privileged := hostConfig.Privileged if ipcMode.IsHost() || pidMode.IsHost() || privileged { - return label.DisableSecOpt(), nil + return toHostConfigSelinuxLabels(label.DisableSecOpt()), nil } var ipcLabel []string @@ -181,7 +188,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig) } ipcLabel = label.DupSecOpt(c.ProcessLabel) if pidContainer == "" { - return ipcLabel, err + return toHostConfigSelinuxLabels(ipcLabel), err } } if pidContainer != "" { @@ -192,7 +199,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig) pidLabel = label.DupSecOpt(c.ProcessLabel) if ipcContainer == "" { - return pidLabel, err + return toHostConfigSelinuxLabels(pidLabel), err } } @@ -202,7 +209,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig) return nil, fmt.Errorf("--ipc and --pid containers SELinux labels aren't the same") } } - return pidLabel, nil + return toHostConfigSelinuxLabels(pidLabel), nil } return nil, nil } diff --git a/daemon/create_unix.go b/daemon/create_unix.go index 2fe5c98a79..7b067bdc22 100644 --- a/daemon/create_unix.go +++ b/daemon/create_unix.go @@ -12,7 +12,7 @@ import ( mounttypes "github.com/docker/docker/api/types/mount" "github.com/docker/docker/container" "github.com/docker/docker/pkg/stringid" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) // createContainerPlatformSpecificSettings performs platform specific container create functionality diff --git a/daemon/daemon_solaris.go b/daemon/daemon_solaris.go index 4a6fac9283..aacb416a88 100644 --- a/daemon/daemon_solaris.go +++ b/daemon/daemon_solaris.go @@ -23,8 +23,8 @@ import ( "github.com/docker/libnetwork/netlabel" "github.com/docker/libnetwork/netutils" lntypes "github.com/docker/libnetwork/types" - "github.com/opencontainers/runc/libcontainer/label" "github.com/opencontainers/runtime-spec/specs-go" + "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" ) diff --git a/daemon/daemon_unix.go b/daemon/daemon_unix.go index 0f342bcfda..7d484cdecf 100644 --- a/daemon/daemon_unix.go +++ b/daemon/daemon_unix.go @@ -41,9 +41,9 @@ import ( lntypes "github.com/docker/libnetwork/types" "github.com/golang/protobuf/ptypes" "github.com/opencontainers/runc/libcontainer/cgroups" - "github.com/opencontainers/runc/libcontainer/label" rsystem "github.com/opencontainers/runc/libcontainer/system" specs "github.com/opencontainers/runtime-spec/specs-go" + "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" "github.com/vishvananda/netlink" ) diff --git a/daemon/graphdriver/aufs/aufs.go b/daemon/graphdriver/aufs/aufs.go index b85596278c..92684199b9 100644 --- a/daemon/graphdriver/aufs/aufs.go +++ b/daemon/graphdriver/aufs/aufs.go @@ -47,8 +47,8 @@ import ( "github.com/docker/docker/pkg/locker" mountpk "github.com/docker/docker/pkg/mount" - "github.com/opencontainers/runc/libcontainer/label" rsystem "github.com/opencontainers/runc/libcontainer/system" + "github.com/opencontainers/selinux/go-selinux/label" ) var ( diff --git a/daemon/graphdriver/btrfs/btrfs.go b/daemon/graphdriver/btrfs/btrfs.go index 0d149c96a2..00d3462097 100644 --- a/daemon/graphdriver/btrfs/btrfs.go +++ b/daemon/graphdriver/btrfs/btrfs.go @@ -28,7 +28,7 @@ import ( "github.com/docker/docker/pkg/mount" "github.com/docker/docker/pkg/parsers" "github.com/docker/go-units" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) func init() { diff --git a/daemon/graphdriver/devmapper/deviceset.go b/daemon/graphdriver/devmapper/deviceset.go index ba845d4d01..5dafc146da 100644 --- a/daemon/graphdriver/devmapper/deviceset.go +++ b/daemon/graphdriver/devmapper/deviceset.go @@ -30,7 +30,7 @@ import ( "github.com/docker/docker/pkg/parsers" units "github.com/docker/go-units" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) var ( diff --git a/daemon/graphdriver/overlay/overlay.go b/daemon/graphdriver/overlay/overlay.go index 357b5952db..805385c138 100644 --- a/daemon/graphdriver/overlay/overlay.go +++ b/daemon/graphdriver/overlay/overlay.go @@ -21,7 +21,7 @@ import ( "github.com/docker/docker/pkg/idtools" "github.com/docker/docker/pkg/locker" "github.com/docker/docker/pkg/mount" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) // This is a small wrapper over the NaiveDiffWriter that lets us have a custom diff --git a/daemon/graphdriver/overlay2/overlay.go b/daemon/graphdriver/overlay2/overlay.go index 74865ba16f..b4d73554dd 100644 --- a/daemon/graphdriver/overlay2/overlay.go +++ b/daemon/graphdriver/overlay2/overlay.go @@ -33,7 +33,7 @@ import ( "github.com/docker/docker/pkg/parsers/kernel" units "github.com/docker/go-units" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) var ( diff --git a/daemon/graphdriver/vfs/driver.go b/daemon/graphdriver/vfs/driver.go index 8832d11531..6812dfd590 100644 --- a/daemon/graphdriver/vfs/driver.go +++ b/daemon/graphdriver/vfs/driver.go @@ -9,7 +9,7 @@ import ( "github.com/docker/docker/pkg/chrootarchive" "github.com/docker/docker/pkg/idtools" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) var ( diff --git a/daemon/graphdriver/zfs/zfs.go b/daemon/graphdriver/zfs/zfs.go index 9ad4733639..bc2b4192a1 100644 --- a/daemon/graphdriver/zfs/zfs.go +++ b/daemon/graphdriver/zfs/zfs.go @@ -19,7 +19,7 @@ import ( "github.com/docker/docker/pkg/mount" "github.com/docker/docker/pkg/parsers" zfs "github.com/mistifyio/go-zfs" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" ) type zfsOptions struct { diff --git a/daemon/selinux_linux.go b/daemon/selinux_linux.go index 83a3447111..fb2578bf4d 100644 --- a/daemon/selinux_linux.go +++ b/daemon/selinux_linux.go @@ -2,16 +2,16 @@ package daemon -import "github.com/opencontainers/runc/libcontainer/selinux" +import "github.com/opencontainers/selinux/go-selinux" func selinuxSetDisabled() { selinux.SetDisabled() } func selinuxFreeLxcContexts(label string) { - selinux.FreeLxcContexts(label) + selinux.ReleaseLabel(label) } func selinuxEnabled() bool { - return selinux.SelinuxEnabled() + return selinux.GetEnabled() } diff --git a/vendor.conf b/vendor.conf index 32b3d9fb46..6eaee0e87e 100644 --- a/vendor.conf +++ b/vendor.conf @@ -142,3 +142,4 @@ github.com/xeipuuv/gojsonpointer e0fe6f68307607d540ed8eac07a342c33fa1b54a github.com/xeipuuv/gojsonreference e02fc20de94c78484cd5ffb007f8af96be030a45 github.com/xeipuuv/gojsonschema 93e72a773fade158921402d6a24c819b48aba29d gopkg.in/yaml.v2 4c78c975fe7c825c6d1466c42be594d1d6f3aba6 +github.com/opencontainers/selinux ba1aefe8057f1d0cfb8e88d0ec1dc85925ef987d diff --git a/vendor/github.com/opencontainers/selinux/LICENSE b/vendor/github.com/opencontainers/selinux/LICENSE new file mode 100644 index 0000000000..8dada3edaf --- /dev/null +++ b/vendor/github.com/opencontainers/selinux/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "{}" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright {yyyy} {name of copyright owner} + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/vendor/github.com/opencontainers/selinux/README.md b/vendor/github.com/opencontainers/selinux/README.md new file mode 100644 index 0000000000..043a929371 --- /dev/null +++ b/vendor/github.com/opencontainers/selinux/README.md @@ -0,0 +1,7 @@ +# selinux + +[![GoDoc](https://godoc.org/github.com/opencontainers/selinux?status.svg)](https://godoc.org/github.com/opencontainers/selinux) [![Go Report Card](https://goreportcard.com/badge/github.com/opencontainers/selinux)](https://goreportcard.com/report/github.com/opencontainers/selinux) [![Build Status](https://travis-ci.org/opencontainers/selinux.svg?branch=master)](https://travis-ci.org/opencontainers/selinux) + +Common SELinux package used across the container ecosystem. + +Please see the [godoc](https://godoc.org/github.com/opencontainers/selinux) for more information. diff --git a/vendor/github.com/opencontainers/runc/libcontainer/label/label.go b/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go similarity index 97% rename from vendor/github.com/opencontainers/runc/libcontainer/label/label.go rename to vendor/github.com/opencontainers/selinux/go-selinux/label/label.go index fddec46334..6cfc5fded8 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/label/label.go +++ b/vendor/github.com/opencontainers/selinux/go-selinux/label/label.go @@ -52,7 +52,7 @@ func ReserveLabel(label string) error { return nil } -func UnreserveLabel(label string) error { +func ReleaseLabel(label string) error { return nil } diff --git a/vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go b/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go similarity index 82% rename from vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go rename to vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go index f469131e97..569dcf0841 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go +++ b/vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go @@ -6,7 +6,7 @@ import ( "fmt" "strings" - "github.com/opencontainers/runc/libcontainer/selinux" + "github.com/opencontainers/selinux/go-selinux" ) // Valid Label Options @@ -25,10 +25,10 @@ var ErrIncompatibleLabel = fmt.Errorf("Bad SELinux option z and Z can not be use // the labels. The labels returned will include a random MCS String, that is // guaranteed to be unique. func InitLabels(options []string) (string, string, error) { - if !selinux.SelinuxEnabled() { + if !selinux.GetEnabled() { return "", "", nil } - processLabel, mountLabel := selinux.GetLxcContexts() + processLabel, mountLabel := selinux.ContainerLabels() if processLabel != "" { pcon := selinux.NewContext(processLabel) mcon := selinux.NewContext(mountLabel) @@ -55,8 +55,8 @@ func InitLabels(options []string) (string, string, error) { return processLabel, mountLabel, nil } -func GetROMountLabel() string { - return selinux.GetROFileLabel() +func ROMountLabel() string { + return selinux.ROFileLabel() } // DEPRECATED: The GenLabels function is only to be used during the transition to the official API. @@ -88,33 +88,33 @@ func SetProcessLabel(processLabel string) error { if processLabel == "" { return nil } - return selinux.Setexeccon(processLabel) + return selinux.SetExecLabel(processLabel) } -// GetProcessLabel returns the process label that the kernel will assign +// ProcessLabel returns the process label that the kernel will assign // to the next program executed by the current process. If "" is returned // this indicates that the default labeling will happen for the process. -func GetProcessLabel() (string, error) { - return selinux.Getexeccon() +func ProcessLabel() (string, error) { + return selinux.ExecLabel() } // GetFileLabel returns the label for specified path -func GetFileLabel(path string) (string, error) { - return selinux.Getfilecon(path) +func FileLabel(path string) (string, error) { + return selinux.FileLabel(path) } // SetFileLabel modifies the "path" label to the specified file label func SetFileLabel(path string, fileLabel string) error { - if selinux.SelinuxEnabled() && fileLabel != "" { - return selinux.Setfilecon(path, fileLabel) + if selinux.GetEnabled() && fileLabel != "" { + return selinux.SetFileLabel(path, fileLabel) } return nil } // SetFileCreateLabel tells the kernel the label for all files to be created func SetFileCreateLabel(fileLabel string) error { - if selinux.SelinuxEnabled() { - return selinux.Setfscreatecon(fileLabel) + if selinux.GetEnabled() { + return selinux.SetFSCreateLabel(fileLabel) } return nil } @@ -123,7 +123,7 @@ func SetFileCreateLabel(fileLabel string) error { // It changes the MCS label to s0 if shared is true. // This will allow all containers to share the content. func Relabel(path string, fileLabel string, shared bool) error { - if !selinux.SelinuxEnabled() { + if !selinux.GetEnabled() { return nil } @@ -147,14 +147,14 @@ func Relabel(path string, fileLabel string, shared bool) error { return nil } -// GetPidLabel will return the label of the process running with the specified pid -func GetPidLabel(pid int) (string, error) { - return selinux.Getpidcon(pid) +// PidLabel will return the label of the process running with the specified pid +func PidLabel(pid int) (string, error) { + return selinux.PidLabel(pid) } // Init initialises the labeling system func Init() { - selinux.SelinuxEnabled() + selinux.GetEnabled() } // ReserveLabel will record the fact that the MCS label has already been used. @@ -165,15 +165,15 @@ func ReserveLabel(label string) error { return nil } -// UnreserveLabel will remove the reservation of the MCS label. +// ReleaseLabel will remove the reservation of the MCS label. // This will allow InitLabels to use the MCS label in a newly created // containers -func UnreserveLabel(label string) error { - selinux.FreeLxcContexts(label) +func ReleaseLabel(label string) error { + selinux.ReleaseLabel(label) return nil } -// DupSecOpt takes an process label and returns security options that +// DupSecOpt takes a process label and returns security options that // can be used to set duplicate labels on future container processes func DupSecOpt(src string) []string { return selinux.DupSecOpt(src) diff --git a/vendor/github.com/opencontainers/runc/libcontainer/selinux/selinux.go b/vendor/github.com/opencontainers/selinux/go-selinux/selinux.go similarity index 60% rename from vendor/github.com/opencontainers/runc/libcontainer/selinux/selinux.go rename to vendor/github.com/opencontainers/selinux/go-selinux/selinux.go index fcaba1d29e..4cf2c45de7 100644 --- a/vendor/github.com/opencontainers/runc/libcontainer/selinux/selinux.go +++ b/vendor/github.com/opencontainers/selinux/go-selinux/selinux.go @@ -15,13 +15,14 @@ import ( "strings" "sync" "syscall" - - "github.com/opencontainers/runc/libcontainer/system" ) const ( - Enforcing = 1 - Permissive = 0 + // Enforcing constant indicate SELinux is in enforcing mode + Enforcing = 1 + // Permissive constant to indicate SELinux is in permissive mode + Permissive = 0 + // Disabled constant to indicate SELinux is disabled Disabled = -1 selinuxDir = "/etc/selinux/" selinuxConfig = selinuxDir + "config" @@ -32,33 +33,74 @@ const ( stRdOnly = 0x01 ) +type selinuxState struct { + enabledSet bool + enabled bool + selinuxfsSet bool + selinuxfs string + mcsList map[string]bool + sync.Mutex +} + var ( - assignRegex = regexp.MustCompile(`^([^=]+)=(.*)$`) - mcsList = make(map[string]bool) - mcsLock sync.Mutex - selinuxfs = "unknown" - selinuxEnabled = false // Stores whether selinux is currently enabled - selinuxEnabledChecked = false // Stores whether selinux enablement has been checked or established yet + assignRegex = regexp.MustCompile(`^([^=]+)=(.*)$`) + state = selinuxState{ + mcsList: make(map[string]bool), + } ) -type SELinuxContext map[string]string +// Context is a representation of the SELinux label broken into 4 parts +type Context map[string]string + +func (s *selinuxState) setEnable(enabled bool) bool { + s.Lock() + defer s.Unlock() + s.enabledSet = true + s.enabled = enabled + return s.enabled +} + +func (s *selinuxState) getEnabled() bool { + s.Lock() + enabled := s.enabled + enabledSet := s.enabledSet + s.Unlock() + if enabledSet { + return enabled + } + + enabled = false + if fs := getSelinuxMountPoint(); fs != "" { + if con, _ := CurrentLabel(); con != "kernel" { + enabled = true + } + } + return s.setEnable(enabled) +} // SetDisabled disables selinux support for the package func SetDisabled() { - selinuxEnabled, selinuxEnabledChecked = false, true + state.setEnable(false) } -// getSelinuxMountPoint returns the path to the mountpoint of an selinuxfs -// filesystem or an empty string if no mountpoint is found. Selinuxfs is -// a proc-like pseudo-filesystem that exposes the selinux policy API to -// processes. The existence of an selinuxfs mount is used to determine -// whether selinux is currently enabled or not. -func getSelinuxMountPoint() string { - if selinuxfs != "unknown" { +func (s *selinuxState) setSELinuxfs(selinuxfs string) string { + s.Lock() + defer s.Unlock() + s.selinuxfsSet = true + s.selinuxfs = selinuxfs + return s.selinuxfs +} + +func (s *selinuxState) getSELinuxfs() string { + s.Lock() + selinuxfs := s.selinuxfs + selinuxfsSet := s.selinuxfsSet + s.Unlock() + if selinuxfsSet { return selinuxfs } - selinuxfs = "" + selinuxfs = "" f, err := os.Open("/proc/self/mountinfo") if err != nil { return selinuxfs @@ -91,21 +133,21 @@ func getSelinuxMountPoint() string { selinuxfs = "" } } - return selinuxfs + return s.setSELinuxfs(selinuxfs) } -// SelinuxEnabled returns whether selinux is currently enabled. -func SelinuxEnabled() bool { - if selinuxEnabledChecked { - return selinuxEnabled - } - selinuxEnabledChecked = true - if fs := getSelinuxMountPoint(); fs != "" { - if con, _ := Getcon(); con != "kernel" { - selinuxEnabled = true - } - } - return selinuxEnabled +// getSelinuxMountPoint returns the path to the mountpoint of an selinuxfs +// filesystem or an empty string if no mountpoint is found. Selinuxfs is +// a proc-like pseudo-filesystem that exposes the selinux policy API to +// processes. The existence of an selinuxfs mount is used to determine +// whether selinux is currently enabled or not. +func getSelinuxMountPoint() string { + return state.getSELinuxfs() +} + +// GetEnabled returns whether selinux is currently enabled. +func GetEnabled() bool { + return state.getEnabled() } func readConfig(target string) (value string) { @@ -166,43 +208,55 @@ func readCon(name string) (string, error) { return val, err } -// Setfilecon sets the SELinux label for this path or returns an error. -func Setfilecon(path string, scon string) error { - return system.Lsetxattr(path, xattrNameSelinux, []byte(scon), 0) +// SetFileLabel sets the SELinux label for this path or returns an error. +func SetFileLabel(path string, label string) error { + return lsetxattr(path, xattrNameSelinux, []byte(label), 0) } -// Getfilecon returns the SELinux label for this path or returns an error. -func Getfilecon(path string) (string, error) { - con, err := system.Lgetxattr(path, xattrNameSelinux) +// Filecon returns the SELinux label for this path or returns an error. +func FileLabel(path string) (string, error) { + label, err := lgetxattr(path, xattrNameSelinux) if err != nil { return "", err } // Trim the NUL byte at the end of the byte buffer, if present. - if len(con) > 0 && con[len(con)-1] == '\x00' { - con = con[:len(con)-1] + if len(label) > 0 && label[len(label)-1] == '\x00' { + label = label[:len(label)-1] } - return string(con), nil + return string(label), nil } -func Setfscreatecon(scon string) error { - return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid()), scon) +/* +SetFSCreateLabel tells kernel the label to create all file system objects +created by this task. Setting label="" to return to default. +*/ +func SetFSCreateLabel(label string) error { + return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid()), label) } -func Getfscreatecon() (string, error) { +/* +FSCreateLabel returns the default label the kernel which the kernel is using +for file system objects created by this task. "" indicates default. +*/ +func FSCreateLabel() (string, error) { return readCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid())) } -// Getcon returns the SELinux label of the current process thread, or an error. -func Getcon() (string, error) { +// CurrentLabel returns the SELinux label of the current process thread, or an error. +func CurrentLabel() (string, error) { return readCon(fmt.Sprintf("/proc/self/task/%d/attr/current", syscall.Gettid())) } -// Getpidcon returns the SELinux label of the given pid, or an error. -func Getpidcon(pid int) (string, error) { +// PidLabel returns the SELinux label of the given pid, or an error. +func PidLabel(pid int) (string, error) { return readCon(fmt.Sprintf("/proc/%d/attr/current", pid)) } -func Getexeccon() (string, error) { +/* +ExecLabel returns the SELinux label that the kernel will use for any programs +that are executed by the current process thread, or an error. +*/ +func ExecLabel() (string, error) { return readCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid())) } @@ -221,19 +275,25 @@ func writeCon(name string, val string) error { return err } -func Setexeccon(scon string) error { - return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid()), scon) +/* +SetExecLabel sets the SELinux label that the kernel will use for any programs +that are executed by the current process thread, or an error. +*/ +func SetExecLabel(label string) error { + return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid()), label) } -func (c SELinuxContext) Get() string { +// Get returns the Context as a string +func (c Context) Get() string { return fmt.Sprintf("%s:%s:%s:%s", c["user"], c["role"], c["type"], c["level"]) } -func NewContext(scon string) SELinuxContext { - c := make(SELinuxContext) +// NewContext creates a new Context struct from the specified label +func NewContext(label string) Context { + c := make(Context) - if len(scon) != 0 { - con := strings.SplitN(scon, ":", 4) + if len(label) != 0 { + con := strings.SplitN(label, ":", 4) c["user"] = con[0] c["role"] = con[1] c["type"] = con[2] @@ -242,9 +302,10 @@ func NewContext(scon string) SELinuxContext { return c } -func ReserveLabel(scon string) { - if len(scon) != 0 { - con := strings.SplitN(scon, ":", 4) +// ReserveLabel reserves the MLS/MCS level component of the specified label +func ReserveLabel(label string) { + if len(label) != 0 { + con := strings.SplitN(label, ":", 4) mcsAdd(con[3]) } } @@ -253,7 +314,8 @@ func selinuxEnforcePath() string { return fmt.Sprintf("%s/enforce", selinuxPath) } -func SelinuxGetEnforce() int { +// EnforceMode returns the current SELinux mode Enforcing, Permissive, Disabled +func EnforceMode() int { var enforce int enforceS, err := readCon(selinuxEnforcePath()) @@ -268,11 +330,20 @@ func SelinuxGetEnforce() int { return enforce } -func SelinuxSetEnforce(mode int) error { +/* +SetEnforce sets the current SELinux mode Enforcing, Permissive. +Disabled is not valid, since this needs to be set at boot time. +*/ +func SetEnforceMode(mode int) error { return writeCon(selinuxEnforcePath(), fmt.Sprintf("%d", mode)) } -func SelinuxGetEnforceMode() int { +/* +DefaultEnforceMode returns the systems default SELinux mode Enforcing, +Permissive or Disabled. Note this is is just the default at boot time. +EnforceMode tells you the systems current mode. +*/ +func DefaultEnforceMode() int { switch readConfig(selinuxTag) { case "enforcing": return Enforcing @@ -283,22 +354,22 @@ func SelinuxGetEnforceMode() int { } func mcsAdd(mcs string) error { - mcsLock.Lock() - defer mcsLock.Unlock() - if mcsList[mcs] { + state.Lock() + defer state.Unlock() + if state.mcsList[mcs] { return fmt.Errorf("MCS Label already exists") } - mcsList[mcs] = true + state.mcsList[mcs] = true return nil } func mcsDelete(mcs string) { - mcsLock.Lock() - mcsList[mcs] = false - mcsLock.Unlock() + state.Lock() + defer state.Unlock() + state.mcsList[mcs] = false } -func IntToMcs(id int, catRange uint32) string { +func intToMcs(id int, catRange uint32) string { var ( SETSIZE = int(catRange) TIER = SETSIZE @@ -334,9 +405,7 @@ func uniqMcs(catRange uint32) string { continue } else { if c1 > c2 { - t := c1 - c1 = c2 - c2 = t + c1, c2 = c2, c1 } } mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2) @@ -348,26 +417,35 @@ func uniqMcs(catRange uint32) string { return mcs } -func FreeLxcContexts(scon string) { - if len(scon) != 0 { - con := strings.SplitN(scon, ":", 4) +/* +ReleaseLabel will unreserve the MLS/MCS Level field of the specified label. +Allowing it to be used by another process. +*/ +func ReleaseLabel(label string) { + if len(label) != 0 { + con := strings.SplitN(label, ":", 4) mcsDelete(con[3]) } } var roFileLabel string -func GetROFileLabel() (fileLabel string) { +// ROFileLabel returns the specified SELinux readonly file label +func ROFileLabel() (fileLabel string) { return roFileLabel } -func GetLxcContexts() (processLabel string, fileLabel string) { +/* +ContainerLabels returns an allocated processLabel and fileLabel to be used for +container labeling by the calling process. +*/ +func ContainerLabels() (processLabel string, fileLabel string) { var ( val, key string bufin *bufio.Reader ) - if !SelinuxEnabled() { + if !GetEnabled() { return "", "" } lxcPath := fmt.Sprintf("%s/contexts/lxc_contexts", getSELinuxPolicyRoot()) @@ -419,7 +497,6 @@ func GetLxcContexts() (processLabel string, fileLabel string) { roFileLabel = fileLabel } exit: - // mcs := IntToMcs(os.Getpid(), 1024) mcs := uniqMcs(1024) scon := NewContext(processLabel) scon["level"] = mcs @@ -430,10 +507,15 @@ exit: return processLabel, fileLabel } +// SecurityCheckContext validates that the SELinux label is understood by the kernel func SecurityCheckContext(val string) error { return writeCon(fmt.Sprintf("%s.context", selinuxPath), val) } +/* +CopyLevel returns a label with the MLS/MCS level from src label replaces on +the dest label. +*/ func CopyLevel(src, dest string) (string, error) { if src == "" { return "", nil @@ -458,31 +540,31 @@ func badPrefix(fpath string) error { for _, prefix := range badprefixes { if fpath == prefix || strings.HasPrefix(fpath, fmt.Sprintf("%s/", prefix)) { - return fmt.Errorf("Relabeling content in %s is not allowed.", prefix) + return fmt.Errorf("relabeling content in %s is not allowed", prefix) } } return nil } -// Chcon changes the fpath file object to the SELinux label scon. +// Chcon changes the fpath file object to the SELinux label label. // If the fpath is a directory and recurse is true Chcon will walk the // directory tree setting the label -func Chcon(fpath string, scon string, recurse bool) error { - if scon == "" { +func Chcon(fpath string, label string, recurse bool) error { + if label == "" { return nil } if err := badPrefix(fpath); err != nil { return err } callback := func(p string, info os.FileInfo, err error) error { - return Setfilecon(p, scon) + return SetFileLabel(p, label) } if recurse { return filepath.Walk(fpath, callback) } - return Setfilecon(fpath, scon) + return SetFileLabel(fpath, label) } // DupSecOpt takes an SELinux process label and returns security options that @@ -498,14 +580,14 @@ func DupSecOpt(src string) []string { con["level"] == "" { return nil } - return []string{"label=user:" + con["user"], - "label=role:" + con["role"], - "label=type:" + con["type"], - "label=level:" + con["level"]} + return []string{"user:" + con["user"], + "role:" + con["role"], + "type:" + con["type"], + "level:" + con["level"]} } // DisableSecOpt returns a security opt that can be used to disabling SELinux // labeling support for future container processes func DisableSecOpt() []string { - return []string{"label=disable"} + return []string{"disable"} } diff --git a/vendor/github.com/opencontainers/selinux/go-selinux/xattrs.go b/vendor/github.com/opencontainers/selinux/go-selinux/xattrs.go new file mode 100644 index 0000000000..7f2ef85049 --- /dev/null +++ b/vendor/github.com/opencontainers/selinux/go-selinux/xattrs.go @@ -0,0 +1,78 @@ +// +build linux + +package selinux + +import ( + "syscall" + "unsafe" +) + +var _zero uintptr + +// Returns a []byte slice if the xattr is set and nil otherwise +// Requires path and its attribute as arguments +func lgetxattr(path string, attr string) ([]byte, error) { + var sz int + pathBytes, err := syscall.BytePtrFromString(path) + if err != nil { + return nil, err + } + attrBytes, err := syscall.BytePtrFromString(attr) + if err != nil { + return nil, err + } + + // Start with a 128 length byte array + sz = 128 + dest := make([]byte, sz) + destBytes := unsafe.Pointer(&dest[0]) + _sz, _, errno := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0) + + switch { + case errno == syscall.ENODATA: + return nil, errno + case errno == syscall.ENOTSUP: + return nil, errno + case errno == syscall.ERANGE: + // 128 byte array might just not be good enough, + // A dummy buffer is used ``uintptr(0)`` to get real size + // of the xattrs on disk + _sz, _, errno = syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(unsafe.Pointer(nil)), uintptr(0), 0, 0) + sz = int(_sz) + if sz < 0 { + return nil, errno + } + dest = make([]byte, sz) + destBytes := unsafe.Pointer(&dest[0]) + _sz, _, errno = syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0) + if errno != 0 { + return nil, errno + } + case errno != 0: + return nil, errno + } + sz = int(_sz) + return dest[:sz], nil +} + +func lsetxattr(path string, attr string, data []byte, flags int) error { + pathBytes, err := syscall.BytePtrFromString(path) + if err != nil { + return err + } + attrBytes, err := syscall.BytePtrFromString(attr) + if err != nil { + return err + } + var dataBytes unsafe.Pointer + if len(data) > 0 { + dataBytes = unsafe.Pointer(&data[0]) + } else { + dataBytes = unsafe.Pointer(&_zero) + } + _, _, errno := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(dataBytes), uintptr(len(data)), uintptr(flags), 0) + if errno != 0 { + return errno + } + return nil +} diff --git a/volume/volume.go b/volume/volume.go index d73e2d511f..91164bc09c 100644 --- a/volume/volume.go +++ b/volume/volume.go @@ -10,7 +10,7 @@ import ( mounttypes "github.com/docker/docker/api/types/mount" "github.com/docker/docker/pkg/idtools" "github.com/docker/docker/pkg/stringid" - "github.com/opencontainers/runc/libcontainer/label" + "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" )