github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #4705 from dweomer/selinx-relabel-dev-shm-but-not-with-hostipc

Browse Source 
cri: selinuxrelabel=false for /dev/shm w/ host ipc
This commit is contained in:
Phil Estes 2020-11-16 21:27:54 -05:00 committed by GitHub
commit 8efb17cc99
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/cri/server/container_create_linux.go
View File

@ -102,7 +102,7 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
ContainerPath: devShm, ContainerPath: devShm,
HostPath: sandboxDevShm, HostPath: sandboxDevShm,
Readonly: false, Readonly: false,
SelinuxRelabel: true, SelinuxRelabel: sandboxDevShm != devShm,
}) })
} }
return mounts return mounts

21
pkg/cri/server/container_create_linux_test.go
View File

@ -455,9 +455,10 @@ func TestContainerMounts(t *testing.T) {
Readonly: true, Readonly: true,
}, },
{ {
ContainerPath: "/dev/shm", ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"), HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false, Readonly: false,
SelinuxRelabel: true,
}, },
}, },
}, },
@ -480,9 +481,10 @@ func TestContainerMounts(t *testing.T) {
Readonly: false, Readonly: false,
}, },
{ {
ContainerPath: "/dev/shm", ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"), HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false, Readonly: false,
SelinuxRelabel: true,
}, },
}, },
}, },
@ -553,9 +555,10 @@ func TestContainerMounts(t *testing.T) {
Readonly: false, Readonly: false,
}, },
{ {
ContainerPath: "/dev/shm", ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"), HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false, Readonly: false,
SelinuxRelabel: true,
}, },
}, },
}, },