vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #112 from rhatdan/selinux

Browse source 
Can't use SELinux separation when sharing the host pid or ipc namespace
This commit is contained in:
Antonio Murdaca 2016-10-07 13:43:55 +02:00 committed by GitHub
commit 356e5f3c22
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
server/sandbox.go
View file

@ -166,9 +166,12 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
return nil, err
}
processLabel, mountLabel, err = getSELinuxLabels(nil)
if err != nil {
return nil, err
// Don't use SELinux separation with Host Pid or IPC Namespace,
if !req.GetConfig().GetLinux().GetNamespaceOptions().GetHostPid() && !req.GetConfig().GetLinux().GetNamespaceOptions().GetHostIpc() {
processLabel, mountLabel, err = getSELinuxLabels(nil)
if err != nil {
return nil, err
}
}
containerID, containerName, err := s.generateContainerIDandName(name, "infra", 0)