kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

In certain cases, setting the process label will not happen.

Browse source 
When the code attempts to set the ProcessLabel, it checks if SELinux Is
enabled.  We have seen a case with some of our patches where the code
is fooled by the container to think that SELinux is not enabled.  Calling
label.Init before setting up the rest of the container, tells the library that
SELinux is enabled and everything works fine.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
This commit is contained in:
Dan Walsh 2014-04-01 10:03:29 -04:00
parent 32ad78b043
commit d76ac4d429
3 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
pkg/label/label.go
View file

@ -21,3 +21,6 @@ func SetFileLabel(path string, fileLabel string) error {
func GetPidCon(pid int) (string, error) {
return "", nil
}
func Init() {
}

4
pkg/label/label_selinux.go
View file

@ -67,3 +67,7 @@ func SetFileLabel(path string, fileLabel string) error {
func GetPidCon(pid int) (string, error) {
return selinux.Getpidcon(pid)
}
func Init() {
selinux.SelinuxEnabled()
}

2
pkg/libcontainer/nsinit/init.go
View file

@ -58,6 +58,8 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
if err := system.ParentDeathSignal(uintptr(syscall.SIGTERM)); err != nil {
return fmt.Errorf("parent death signal %s", err)
}
label.Init()
ns.logger.Println("setup mount namespace")
if err := setupNewMountNamespace(rootfs, container.Mounts, console, container.ReadonlyFs, container.NoPivotRoot, container.Context["mount_label"]); err != nil {
return fmt.Errorf("setup mount namespace %s", err)