vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

This patch reworks the SELinux patch to be only run on demand by the daemon

Browse source 
Added --selinux-enable switch to daemon to enable SELinux labeling.

The daemon will now generate a new unique random SELinux label when a
container starts, and remove it when the container is removed.   The MCS
labels will be stored in the daemon memory.  The labels of containers will
be stored in the container.json file.

When the daemon restarts on boot or if done by an admin, it will read all containers json files and reserve the MCS labels.

A potential problem would be conflicts if you setup thousands of containers,
current scheme would handle ~500,000 containers.

Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: rhatdan)
Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh@redhat.com> (github: crosbymichael)
This commit is contained in:
Dan Walsh 2014-04-21 17:09:26 -04:00 • committed by Michael Crosby
parent 48d893cc6b
commit d0559e92af
4 changed files with 34 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
label/label.go
View file

@ -24,3 +24,7 @@ func GetPidCon(pid int) (string, error) {
func Init() {
}
func ReserveLabel(label string) error {
return nil
}