Fix handling of user specified container labels #11101
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rhatdan The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
| @@ -50,6 +50,14 @@ function check_label() { | |||
| check_label "--systemd=always" "container_init_t" | |||
| } | |||
|
|
|||
| @test "podman selinux: init container with --security-opt type" { | |||
| check_label "--systemd=always --security-opt=label=type:spc_t" "spc_t" | |||
There was a problem hiding this comment.
This test fails (root and rootless) on my laptop: gets container_init_t instead of spc_t.
There was a problem hiding this comment.
Should not edit, test, edit, push? :^(
test/system/410-selinux.bats
Outdated
| } | ||
|
|
||
| @test "podman selinux: init container with --security-opt level" { | ||
| check_label "--systemd=always --security-opt=label=level:s0:c1,c2" "container_init_t" |
There was a problem hiding this comment.
This test passes, but it also passes in podman without your PR. (IOW, this is a test of functionality already present in podman. Which is fine by me, I like extra tests, but I wanted to make sure you weren't expecting this to be a test for your fix).
There was a problem hiding this comment.
I want to make sure my changes do not change this behavior. IE I want to make sure we still get container_init_t if we change the level without changing the type.
Currently we override the SELinux labels specified by the user if the container is runing a kata container or systemd container. This PR fixes to use the label specified by the user. Fixes: containers#11100 Signed-off-by: Daniel J Walsh <[email protected]>
|
Tests LGTM now, thanks |
openshift-ci
bot
added
the
do-not-merge/hold
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
github-actions
bot
added
the
locked - please file new issue/PR
Currently we override the SELinux labels specified by the user
if the container is runing a kata container or systemd container.
This PR fixes to use the label specified by the user.
Fixes: #11100
Signed-off-by: Daniel J Walsh [email protected]