vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Can't use SELinux separation when sharing the host pid/ipc namespace

Browse source 
SELinux will cause breakage when sharing these namespaces.  For example it
will block processes inside of the container from looking at the hosts /proc
in hosts Pid Namespace.  It will also block all access to semaphores and
shared memory defined outside of the pod.

Signed-off-by: Dan Walsh <dwalsh@redhat.com>
This commit is contained in:
Dan Walsh 2016-10-07 07:24:49 -04:00
parent fbcd609644
commit cd12a4acfe
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
server/sandbox.go
View file

@ -166,9 +166,12 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
return nil, err
}
processLabel, mountLabel, err = getSELinuxLabels(nil)
if err != nil {
return nil, err
// Don't use SELinux separation with Host Pid or IPC Namespace,
if !req.GetConfig().GetLinux().GetNamespaceOptions().GetHostPid() && !req.GetConfig().GetLinux().GetNamespaceOptions().GetHostIpc() {
processLabel, mountLabel, err = getSELinuxLabels(nil)
if err != nil {
return nil, err
}
}
containerID, containerName, err := s.generateContainerIDandName(name, "infra", 0)