Skip to content
Permalink
Browse files

add selinux label for runc exec

Signed-off-by: lifubang <lifubang@acmcoder.com>
  • Loading branch information...
lifubang committed Apr 3, 2019
1 parent da20211 commit 3e6688f5c9defb3f8e8749a187264955988871d1
Showing with 5 additions and 1 deletion.
  1. +1 −1 exec.go
  2. +4 −0 utils_linux.go
@@ -224,5 +224,5 @@ func getProcess(context *cli.Context, bundle string) (*specs.Process, error) {
}
p.User.AdditionalGids = append(p.User.AdditionalGids, uint32(gid))
}
return p, nil
return p, validateProcessSpec(p)
}
@@ -17,6 +17,7 @@ import (
"github.com/opencontainers/runc/libcontainer/specconv"
"github.com/opencontainers/runc/libcontainer/utils"
"github.com/opencontainers/runtime-spec/specs-go"
selinux "github.com/opencontainers/selinux/go-selinux"

"github.com/coreos/go-systemd/activation"
"github.com/pkg/errors"
@@ -387,6 +388,9 @@ func validateProcessSpec(spec *specs.Process) error {
if len(spec.Args) == 0 {
return fmt.Errorf("args must not be empty")
}
if spec.SelinuxLabel != "" && !selinux.GetEnabled() {
return fmt.Errorf("selinux label is specified in config, but selinux is disabled or not supported")
}
return nil
}

0 comments on commit 3e6688f

Please sign in to comment.
You can’t perform that action at this time.