github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #4705 from dweomer/selinx-relabel-dev-shm-but-not-with-hostipc

Browse Source 
cri: selinuxrelabel=false for /dev/shm w/ host ipc
This commit is contained in:
Phil Estes 2020-11-16 21:27:54 -05:00 committed by GitHub
commit 8efb17cc99
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/cri/server/container_create_linux.go
View File

@ -102,7 +102,7 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
ContainerPath: devShm,
HostPath: sandboxDevShm,
Readonly: false,
SelinuxRelabel: true,
SelinuxRelabel: sandboxDevShm != devShm,
})
}
return mounts

21
pkg/cri/server/container_create_linux_test.go
View File

@ -455,9 +455,10 @@ func TestContainerMounts(t *testing.T) {
Readonly: true,
},
{
ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false,
ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false,
SelinuxRelabel: true,
},
},
},
@ -480,9 +481,10 @@ func TestContainerMounts(t *testing.T) {
Readonly: false,
},
{
ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false,
ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false,
SelinuxRelabel: true,
},
},
},
@ -553,9 +555,10 @@ func TestContainerMounts(t *testing.T) {
Readonly: false,
},
{
ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false,
ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false,
SelinuxRelabel: true,
},
},
},