vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #112 from rhatdan/selinux

Browse source 
Can't use SELinux separation when sharing the host pid or ipc namespace
This commit is contained in:
Antonio Murdaca 2016-10-07 13:43:55 +02:00 committed by GitHub
commit 356e5f3c22
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
server/sandbox.go
View file

@ -166,10 +166,13 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
return nil, err return nil, err
} }
// Don't use SELinux separation with Host Pid or IPC Namespace,
if !req.GetConfig().GetLinux().GetNamespaceOptions().GetHostPid() && !req.GetConfig().GetLinux().GetNamespaceOptions().GetHostIpc() {
processLabel, mountLabel, err = getSELinuxLabels(nil) processLabel, mountLabel, err = getSELinuxLabels(nil)
if err != nil { if err != nil {
return nil, err return nil, err
} }
}
containerID, containerName, err := s.generateContainerIDandName(name, "infra", 0) containerID, containerName, err := s.generateContainerIDandName(name, "infra", 0)
g.AddAnnotation("ocid/labels", string(labelsJSON)) g.AddAnnotation("ocid/labels", string(labelsJSON))