feature: support selinux #4639
feature: support selinux #4639
Conversation
ningmingxiao
force-pushed
the
selinux_support
branch
7 times, most recently
from
d69b7e0 to
2eaa687
Compare
ningmingxiao
changed the title
ningmingxiao
force-pushed
the
selinux_support
branch
from
2eaa687 to
1e356d6
Compare
ningmingxiao
force-pushed
the
selinux_support
branch
from
1e356d6 to
56a8926
Compare
| if err != nil { | ||
| output := strings.TrimSpace(string(stdout)) | ||
| if strings.Contains(output, "container_t") { | ||
| t.Fatal(fmt.Errorf("expect label container_t but get %s", output)) |
There was a problem hiding this comment.
The uniqueness of the MCS categories have to be checked too?
There was a problem hiding this comment.
what do you think how to check? @AkihiroSuda
There was a problem hiding this comment.
Just run multiple containers and check that the MCS categories are different
There was a problem hiding this comment.
because nerdctl doesn't save selinux label into db, nerdctl is a brief process， so may have chance to have same MCS categories . may be I should refer container id to keep special.
There was a problem hiding this comment.
what's the disadvantage if 2 containers have same MCS categories ?
There was a problem hiding this comment.
or we should let containerd call label.InitLabels(labelOpts) instead of let nerdctl create it @AkihiroSuda
ningmingxiao
force-pushed
the
selinux_support
branch
from
56a8926 to
a210aa3
Compare
ningmingxiao
force-pushed
the
selinux_support
branch
5 times, most recently
from
ec3feb9 to
977dba6
Compare
| selinux_enabled= true | ||
| ``` | ||
|
|
||
| ## Properties |
There was a problem hiding this comment.
I don't understand what you meean ? about selinux_enabled= true @AkihiroSuda
| { | ||
| Description: "test run with selinux-enabled", | ||
| Command: func(data test.Data, helpers test.Helpers) test.TestableCommand { | ||
| return helpers.Command("--selinux-enabled", "run", "-d", "-v", fmt.Sprintf("/%s:/%s:Z", testContainer, testContainer), "--name", testContainer, "sleep", "infinity") |
There was a problem hiding this comment.
lower z should be tested too
https://docs.docker.com/engine/storage/bind-mounts/#configure-the-selinux-label
The z option indicates that the bind mount content is shared among multiple containers.
The Z option indicates that the bind mount content is private and unshared.
This should be verified by launching multiple containers
|
Needs rebase |
ningmingxiao
force-pushed
the
selinux_support
branch
3 times, most recently
from
565bbde to
59bc5ef
Compare
done |
Signed-off-by: ningmingxiao <[email protected]>
ningmingxiao
force-pushed
the
selinux_support
branch
from
59bc5ef to
e32acb4
Compare
|
do we need add a new api in containerd to manage selinuxlabel ? because " label.InitLabels(labelOptions)" should run on server to keep unique @AkihiroSuda |
2 participants
ping @AkihiroSuda