Merge pull request #377 from nak3/selinux-docker-driver

Apply SELinux label to allocate directory of docker driver
hashicorp · Nov 5, 2015 · cb811dd · cb811dd
2 parents b0464a5 + c94bf6b
commit cb811dd
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/client/driver/docker.go b/client/driver/docker.go
@@ -108,8 +108,10 @@ func (d *DockerDriver) containerBinds(alloc *allocdir.AllocDir, task *structs.Ta
 	}
 
 	return []string{
-		fmt.Sprintf("%s:%s", shared, allocdir.SharedAllocName),
-		fmt.Sprintf("%s:%s", local, allocdir.TaskLocal),
+		// "z" and "Z" option is to allocate directory with SELinux label.
+		fmt.Sprintf("%s:/%s:rw,z", shared, allocdir.SharedAllocName),
+		// capital "Z" will label with Multi-Category Security (MCS) labels
+		fmt.Sprintf("%s:/%s:rw,Z", local, allocdir.TaskLocal),
 	}, nil
 }