Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

modify default label for containers #1318

Merged
merged 2 commits into from
Feb 17, 2021
Merged

modify default label for containers #1318

merged 2 commits into from
Feb 17, 2021

Commits on Feb 16, 2021

  1. selinux-policy: modify default label for containers 

    This changes the default label from `container_t`, which is meant as
the unprivileged type, to `control_t`, which has higher privileges,
including the ability to write to the host API socket.

This is better aligned with the SELinux logic in containerd's CRI
plugin and in the docker daemon, where the label from lxc_contexts is
used for unprivileged containers, while privileged containers are not
explicitly labeled and follow the default transition rules.

Signed-off-by: Ben Cressey <bcressey@amazon.com>
    @bcressey
    bcressey committed Feb 16, 2021
    Configuration menu
    Copy the full SHA
    59264b4 View commit details
    Browse the repository at this point in the history

  2. docs: update SELinux details in SECURITY_GUIDANCE.md 

    This documents the switch to running privileged containers with the
`control_t` label by default, and describes the implications.

Signed-off-by: Ben Cressey <bcressey@amazon.com>
    @bcressey
    bcressey committed Feb 16, 2021
    Configuration menu
    Copy the full SHA
    2653973 View commit details
    Browse the repository at this point in the history