Ignore relabeling ENOSUP failure #343
Conversation
Some file systems like NFS do not support labeling. We should ignore these failures and continue on. SELinux policy might need to be adjusted to allow access, but the relabeling can not be fixed. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
| @@ -51,7 +52,7 @@ func (daemon *Daemon) createContainerPlatformSpecificSettings(container *contain | |||
| return err | |||
| } | |||
|
|
|||
| if err := label.Relabel(v.Path(), container.MountLabel, true); err != nil { | |||
| if err := label.Relabel(v.Path(), container.MountLabel, true); err != nil && err != syscall.ENOTSUP { | |||
There was a problem hiding this comment.
Outside of nfs, is there ever a time when we'd get a ENOTSUP and want to return that as an error?
There was a problem hiding this comment.
Relabelling of volumes is our attempt to change the builtin labels to something that the container can use. If the volume is not relabeled in the worse case, the container will fail to be able to use the volume and throw a permission denied error and generate AVCs.
Which is better then failing, when the policy might allow the container to use the unrelabeled content, as it would with NFS.
I believe this is in upstream docker now, to ignore ENOSUP. Other relabelling code in this repo ignore the ENOSUP error.
|
Change LGTM, I'm just a little leery that we might be letting things through that shouldn't be let through. Fix one, make another bug type of thing. |
Some file systems like NFS do not support labeling. We should ignore these failures
and continue on. SELinux policy might need to be adjusted to allow access, but the
relabeling can not be fixed.
Signed-off-by: Daniel J Walsh dwalsh@redhat.com
- What I did
- How I did it
- How to verify it
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)