Apply SELinux label to allocate directory of docker driver #377
Conversation
|
Without this fix, driver test (i.e. |
| @@ -108,8 +108,8 @@ func (d *DockerDriver) containerBinds(alloc *allocdir.AllocDir, task *structs.Ta | |||
| } | |||
|
|
|||
| return []string{ | |||
| fmt.Sprintf("%s:%s", shared, allocdir.SharedAllocName), | |||
| fmt.Sprintf("%s:%s", local, allocdir.TaskLocal), | |||
| fmt.Sprintf("%s:%s:rw,Z", shared, allocdir.SharedAllocName), | |||
There was a problem hiding this comment.
The shared alloc is shared across containers so it should be z (lowercase)
There was a problem hiding this comment.
Please put a comment on why these are needed above
|
Thanks, I updated. |
| // "z" and "Z" option is to allocate directory with SELinux label. | ||
| fmt.Sprintf("%s:%s:rw,z", shared, allocdir.SharedAllocName), | ||
| // capital "Z" will label with Multi-Category Security (MCS) labels | ||
| fmt.Sprintf("%s:%s:rw,Z", local, allocdir.TaskLocal), |
There was a problem hiding this comment.
I pulled your branch and you need to add one more thing for it to work.
Can you change %s:%s to %s:/%s on both of them. It needs to be an absolute path with that flag.
|
Thanks again. I updated. The test scripts passed both (w/ or w/o |
Apply SELinux label to allocate directory of docker driver
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
No description provided.