Merge pull request #1627 from runcom/selinux-moar-fixes

sandbox,container: more selinux label fixes
cri-o · Jun 18, 2018 · bd1dec3 · bd1dec3
2 parents ace0093 + 6cf08a7
commit bd1dec3
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 6 deletions.
diff --git a/server/container_create.go b/server/container_create.go
@@ -136,7 +136,6 @@ func addOCIBindMounts(mountLabel string, containerConfig *pb.ContainerConfig, sp
 		}
 
 		if mount.SelinuxRelabel {
-			// Need a way in kubernetes to determine if the volume is shared or private
 			if err := label.Relabel(src, mountLabel, false); err != nil && err != unix.ENOTSUP {
 				return nil, nil, fmt.Errorf("relabel failed %s: %v", src, err)
 			}
@@ -1178,7 +1177,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
 		options = []string{"ro"}
 	}
 	if sb.ResolvPath() != "" {
-		if err := label.Relabel(sb.ResolvPath(), mountLabel, true); err != nil && err != unix.ENOTSUP {
+		if err := label.Relabel(sb.ResolvPath(), mountLabel, false); err != nil && err != unix.ENOTSUP {
 			return nil, err
 		}
 
@@ -1193,7 +1192,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
 	}
 
 	if sb.HostnamePath() != "" {
-		if err := label.Relabel(sb.HostnamePath(), mountLabel, true); err != nil && err != unix.ENOTSUP {
+		if err := label.Relabel(sb.HostnamePath(), mountLabel, false); err != nil && err != unix.ENOTSUP {
 			return nil, err
 		}
 
@@ -1573,7 +1572,7 @@ func setupWorkingDirectory(rootfs, mountLabel, containerCwd string) error {
 		return err
 	}
 	if mountLabel != "" {
-		if err1 := label.Relabel(fp, mountLabel, true); err1 != nil && err1 != unix.ENOTSUP {
+		if err1 := label.Relabel(fp, mountLabel, false); err1 != nil && err1 != unix.ENOTSUP {
 			return fmt.Errorf("relabel failed %s: %v", fp, err1)
 		}
 	}

diff --git a/server/sandbox_run.go b/server/sandbox_run.go
@@ -353,7 +353,7 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 			}
 			return nil, err
 		}
-		if err := label.Relabel(resolvPath, mountLabel, true); err != nil && err != unix.ENOTSUP {
+		if err := label.Relabel(resolvPath, mountLabel, false); err != nil && err != unix.ENOTSUP {
 			return nil, err
 		}
 		mnt := runtimespec.Mount{
@@ -676,7 +676,7 @@ func (s *Server) RunPodSandbox(ctx context.Context, req *pb.RunPodSandboxRequest
 	if err := ioutil.WriteFile(hostnamePath, []byte(hostname+"\n"), 0644); err != nil {
 		return nil, err
 	}
-	if err := label.Relabel(hostnamePath, mountLabel, true); err != nil && err != unix.ENOTSUP {
+	if err := label.Relabel(hostnamePath, mountLabel, false); err != nil && err != unix.ENOTSUP {
 		return nil, err
 	}
 	mnt = runtimespec.Mount{