vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Add more label checks for selinux enabled

Browse source 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-04-07 14:09:46 -07:00
parent c05f329be8
commit 08ed0c8761
1 changed files with 20 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
label/label_selinux.go
View file

@ -9,30 +9,31 @@ import (
) )
func GenLabels(options string) (string, string, error) { func GenLabels(options string) (string, string, error) {
processLabel, mountLabel := selinux.GetLxcContexts() if !selinux.SelinuxEnabled() {
if processLabel == "" { // SELinux is disabled
return "", "", nil return "", "", nil
} }
var err error
var ( processLabel, mountLabel := selinux.GetLxcContexts()
err error if processLabel != "" {
s = strings.Fields(options) var (
l = len(s) s = strings.Fields(options)
) l = len(s)
if l > 0 { )
pcon := selinux.NewContext(processLabel) if l > 0 {
for i := 0; i < l; i++ { pcon := selinux.NewContext(processLabel)
o := strings.Split(s[i], "=") for i := 0; i < l; i++ {
pcon[o[0]] = o[1] o := strings.Split(s[i], "=")
pcon[o[0]] = o[1]
}
processLabel = pcon.Get()
mountLabel, err = selinux.CopyLevel(processLabel, mountLabel)
} }
processLabel = pcon.Get()
mountLabel, err = selinux.CopyLevel(processLabel, mountLabel)
} }
return processLabel, mountLabel, err return processLabel, mountLabel, err
} }
func FormatMountLabel(src string, mountLabel string) string { func FormatMountLabel(src string, mountLabel string) string {
if mountLabel != "" { if selinux.SelinuxEnabled() && mountLabel != "" {
switch src { switch src {
case "": case "":
src = fmt.Sprintf("%s,context=%s", src, mountLabel) src = fmt.Sprintf("%s,context=%s", src, mountLabel)
@ -65,6 +66,9 @@ func SetFileLabel(path string, fileLabel string) error {
} }
func GetPidCon(pid int) (string, error) { func GetPidCon(pid int) (string, error) {
if !selinux.SelinuxEnabled() {
return "", nil
}
return selinux.Getpidcon(pid) return selinux.Getpidcon(pid)
} }