Skip to content
Permalink
Browse files

Merge pull request #2031 from lifubang/selinux

Add selinux validate in runc exec
  • Loading branch information...
crosbymichael committed Apr 3, 2019
2 parents 6a3f474 + 3e6688f commit 029124da7af7360afa781a0234d1b083550f797c
Showing with 5 additions and 1 deletion.
  1. +1 −1 exec.go
  2. +4 −0 utils_linux.go
@@ -224,5 +224,5 @@ func getProcess(context *cli.Context, bundle string) (*specs.Process, error) {
}
p.User.AdditionalGids = append(p.User.AdditionalGids, uint32(gid))
}
return p, nil
return p, validateProcessSpec(p)
}
@@ -17,6 +17,7 @@ import (
"github.com/opencontainers/runc/libcontainer/specconv"
"github.com/opencontainers/runc/libcontainer/utils"
"github.com/opencontainers/runtime-spec/specs-go"
selinux "github.com/opencontainers/selinux/go-selinux"

"github.com/coreos/go-systemd/activation"
"github.com/pkg/errors"
@@ -387,6 +388,9 @@ func validateProcessSpec(spec *specs.Process) error {
if len(spec.Args) == 0 {
return fmt.Errorf("args must not be empty")
}
if spec.SelinuxLabel != "" && !selinux.GetEnabled() {
return fmt.Errorf("selinux label is specified in config, but selinux is disabled or not supported")
}
return nil
}

0 comments on commit 029124d

Please sign in to comment.
You can’t perform that action at this time.