github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

cri: selinuxrelabel=false for /dev/shm w/ host ipc

Browse Source 
This is a followup to #4699 that addresses an oversight that could cause
the CRI to relabel the host /dev/shm, which should be a no-op in most
cases. Additionally, fixes unit tests to make correct assertions for
/dev/shm relabeling.

Discovered while applying the changes for #4699 to containerd/cri 1.4:
https://github.com/containerd/cri/pull/1605

Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
This commit is contained in:
Jacob Blain Christen 2020-11-09 11:24:24 -07:00
parent 293b08dd19
commit a1e7dd939d
2 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/cri/server/container_create_linux.go
View File

@ -102,7 +102,7 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
ContainerPath: devShm, ContainerPath: devShm,
HostPath: sandboxDevShm, HostPath: sandboxDevShm,
Readonly: false, Readonly: false,
SelinuxRelabel: true, SelinuxRelabel: sandboxDevShm != devShm,
}) })
} }
return mounts return mounts

3
pkg/cri/server/container_create_linux_test.go
View File

@ -458,6 +458,7 @@ func TestContainerMounts(t *testing.T) {
ContainerPath: "/dev/shm", ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"), HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false, Readonly: false,
SelinuxRelabel: true,
}, },
}, },
}, },
@ -483,6 +484,7 @@ func TestContainerMounts(t *testing.T) {
ContainerPath: "/dev/shm", ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"), HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false, Readonly: false,
SelinuxRelabel: true,
}, },
}, },
}, },
@ -556,6 +558,7 @@ func TestContainerMounts(t *testing.T) {
ContainerPath: "/dev/shm", ContainerPath: "/dev/shm",
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"), HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
Readonly: false, Readonly: false,
SelinuxRelabel: true,
}, },
}, },
}, },