vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Add SELinux support to OCID

Browse source 
Signed-off-by: Dan Walsh <dwalsh@redhat.com>
This commit is contained in:
Dan Walsh 2016-10-05 09:29:30 -04:00
parent 308cc4a3b5
commit be77b841fa
5 changed files with 84 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

19
server/server.go
View file

@ -13,6 +13,7 @@ import (
"github.com/docker/docker/pkg/truncindex"
"github.com/kubernetes-incubator/cri-o/oci"
"github.com/kubernetes-incubator/cri-o/utils"
"github.com/opencontainers/runc/libcontainer/label"
rspec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/rajatchopra/ocicni"
)
@ -55,14 +56,22 @@ func (s *Server) loadSandbox(id string) error {
if err != nil {
return err
}
processLabel, mountLabel, err := label.InitLabels(label.DupSecOpt(m.Process.SelinuxLabel))
if err != nil {
return err
}
s.addSandbox(&sandbox{
id: id,
name: name,
logDir: m.Annotations["ocid/log_path"],
labels: labels,
containers: oci.NewMemoryStore(),
id: id,
name: name,
logDir: m.Annotations["ocid/log_path"],
labels: labels,
containers: oci.NewMemoryStore(),
processLabel: processLabel,
mountLabel: mountLabel,
})
sandboxPath := filepath.Join(s.sandboxDir, id)
scontainer, err := oci.NewContainer(m.Annotations["ocid/container_id"], m.Annotations["ocid/container_name"], sandboxPath, sandboxPath, labels, id, false)
if err != nil {
return err