Skip to content

Commit abbbf91

Browse files
runcomruncom
committed
Switch to using opencontainers/selinux for selinux bindings
Signed-off-by: Antonio Murdaca <[email protected]>
1 parent 3482b45 commit abbbf91

File tree

23 files changed

+515
-139
lines changed

23 files changed

+515
-139
lines changed

‎container/container.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ import (
4343
"github.com/docker/libnetwork/options"
4444
"github.com/docker/libnetwork/types"
4545
agentexec "github.com/docker/swarmkit/agent/exec"
46-
"github.com/opencontainers/runc/libcontainer/label"
46+
"github.com/opencontainers/selinux/go-selinux/label"
4747
)
4848

4949
const configFileName = "config.v2.json"

‎container/container_unix.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import (
1717
"github.com/docker/docker/pkg/symlink"
1818
"github.com/docker/docker/pkg/system"
1919
"github.com/docker/docker/volume"
20-
"github.com/opencontainers/runc/libcontainer/label"
20+
"github.com/opencontainers/selinux/go-selinux/label"
2121
"golang.org/x/sys/unix"
2222
)
2323

‎daemon/container_operations_unix.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ import (
1919
"github.com/docker/docker/pkg/stringid"
2020
"github.com/docker/docker/runconfig"
2121
"github.com/docker/libnetwork"
22-
"github.com/opencontainers/runc/libcontainer/label"
22+
"github.com/opencontainers/selinux/go-selinux/label"
2323
"github.com/pkg/errors"
2424
)
2525

‎daemon/create.go

+12-5
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import (
2020
"github.com/docker/docker/pkg/idtools"
2121
"github.com/docker/docker/pkg/stringid"
2222
"github.com/docker/docker/runconfig"
23-
"github.com/opencontainers/runc/libcontainer/label"
23+
"github.com/opencontainers/selinux/go-selinux/label"
2424
)
2525

2626
// CreateManagedContainer creates a container that is managed by a Service
@@ -155,6 +155,13 @@ func (daemon *Daemon) create(params types.ContainerCreateConfig, managed bool) (
155155
return container, nil
156156
}
157157

158+
func toHostConfigSelinuxLabels(labels []string) []string {
159+
for i, l := range labels {
160+
labels[i] = "label=" + l
161+
}
162+
return labels
163+
}
164+
158165
func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig) ([]string, error) {
159166
for _, opt := range hostConfig.SecurityOpt {
160167
con := strings.Split(opt, "=")
@@ -167,7 +174,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)
167174
pidMode := hostConfig.PidMode
168175
privileged := hostConfig.Privileged
169176
if ipcMode.IsHost() || pidMode.IsHost() || privileged {
170-
return label.DisableSecOpt(), nil
177+
return toHostConfigSelinuxLabels(label.DisableSecOpt()), nil
171178
}
172179

173180
var ipcLabel []string
@@ -181,7 +188,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)
181188
}
182189
ipcLabel = label.DupSecOpt(c.ProcessLabel)
183190
if pidContainer == "" {
184-
return ipcLabel, err
191+
return toHostConfigSelinuxLabels(ipcLabel), err
185192
}
186193
}
187194
if pidContainer != "" {
@@ -192,7 +199,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)
192199

193200
pidLabel = label.DupSecOpt(c.ProcessLabel)
194201
if ipcContainer == "" {
195-
return pidLabel, err
202+
return toHostConfigSelinuxLabels(pidLabel), err
196203
}
197204
}
198205

@@ -202,7 +209,7 @@ func (daemon *Daemon) generateSecurityOpt(hostConfig *containertypes.HostConfig)
202209
return nil, fmt.Errorf("--ipc and --pid containers SELinux labels aren't the same")
203210
}
204211
}
205-
return pidLabel, nil
212+
return toHostConfigSelinuxLabels(pidLabel), nil
206213
}
207214
return nil, nil
208215
}

‎daemon/create_unix.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import (
1212
mounttypes "github.com/docker/docker/api/types/mount"
1313
"github.com/docker/docker/container"
1414
"github.com/docker/docker/pkg/stringid"
15-
"github.com/opencontainers/runc/libcontainer/label"
15+
"github.com/opencontainers/selinux/go-selinux/label"
1616
)
1717

1818
// createContainerPlatformSpecificSettings performs platform specific container create functionality

‎daemon/daemon_solaris.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ import (
2323
"github.com/docker/libnetwork/netlabel"
2424
"github.com/docker/libnetwork/netutils"
2525
lntypes "github.com/docker/libnetwork/types"
26-
"github.com/opencontainers/runc/libcontainer/label"
2726
"github.com/opencontainers/runtime-spec/specs-go"
27+
"github.com/opencontainers/selinux/go-selinux/label"
2828
"github.com/pkg/errors"
2929
)
3030

‎daemon/daemon_unix.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,9 @@ import (
4141
lntypes "github.com/docker/libnetwork/types"
4242
"github.com/golang/protobuf/ptypes"
4343
"github.com/opencontainers/runc/libcontainer/cgroups"
44-
"github.com/opencontainers/runc/libcontainer/label"
4544
rsystem "github.com/opencontainers/runc/libcontainer/system"
4645
specs "github.com/opencontainers/runtime-spec/specs-go"
46+
"github.com/opencontainers/selinux/go-selinux/label"
4747
"github.com/pkg/errors"
4848
"github.com/vishvananda/netlink"
4949
)

‎daemon/graphdriver/aufs/aufs.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ import (
4747
"github.com/docker/docker/pkg/locker"
4848
mountpk "github.com/docker/docker/pkg/mount"
4949

50-
"github.com/opencontainers/runc/libcontainer/label"
5150
rsystem "github.com/opencontainers/runc/libcontainer/system"
51+
"github.com/opencontainers/selinux/go-selinux/label"
5252
)
5353

5454
var (

‎daemon/graphdriver/btrfs/btrfs.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ import (
2828
"github.com/docker/docker/pkg/mount"
2929
"github.com/docker/docker/pkg/parsers"
3030
"github.com/docker/go-units"
31-
"github.com/opencontainers/runc/libcontainer/label"
31+
"github.com/opencontainers/selinux/go-selinux/label"
3232
)
3333

3434
func init() {

‎daemon/graphdriver/devmapper/deviceset.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ import (
3030
"github.com/docker/docker/pkg/parsers"
3131
units "github.com/docker/go-units"
3232

33-
"github.com/opencontainers/runc/libcontainer/label"
33+
"github.com/opencontainers/selinux/go-selinux/label"
3434
)
3535

3636
var (

‎daemon/graphdriver/overlay/overlay.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import (
2121
"github.com/docker/docker/pkg/idtools"
2222
"github.com/docker/docker/pkg/locker"
2323
"github.com/docker/docker/pkg/mount"
24-
"github.com/opencontainers/runc/libcontainer/label"
24+
"github.com/opencontainers/selinux/go-selinux/label"
2525
)
2626

2727
// This is a small wrapper over the NaiveDiffWriter that lets us have a custom

‎daemon/graphdriver/overlay2/overlay.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ import (
3333
"github.com/docker/docker/pkg/parsers/kernel"
3434
units "github.com/docker/go-units"
3535

36-
"github.com/opencontainers/runc/libcontainer/label"
36+
"github.com/opencontainers/selinux/go-selinux/label"
3737
)
3838

3939
var (

‎daemon/graphdriver/vfs/driver.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99
"github.com/docker/docker/pkg/chrootarchive"
1010
"github.com/docker/docker/pkg/idtools"
1111

12-
"github.com/opencontainers/runc/libcontainer/label"
12+
"github.com/opencontainers/selinux/go-selinux/label"
1313
)
1414

1515
var (

‎daemon/graphdriver/zfs/zfs.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ import (
1919
"github.com/docker/docker/pkg/mount"
2020
"github.com/docker/docker/pkg/parsers"
2121
zfs "github.com/mistifyio/go-zfs"
22-
"github.com/opencontainers/runc/libcontainer/label"
22+
"github.com/opencontainers/selinux/go-selinux/label"
2323
)
2424

2525
type zfsOptions struct {

‎daemon/selinux_linux.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,16 @@
22

33
package daemon
44

5-
import "github.com/opencontainers/runc/libcontainer/selinux"
5+
import "github.com/opencontainers/selinux/go-selinux"
66

77
func selinuxSetDisabled() {
88
selinux.SetDisabled()
99
}
1010

1111
func selinuxFreeLxcContexts(label string) {
12-
selinux.FreeLxcContexts(label)
12+
selinux.ReleaseLabel(label)
1313
}
1414

1515
func selinuxEnabled() bool {
16-
return selinux.SelinuxEnabled()
16+
return selinux.GetEnabled()
1717
}

‎vendor.conf

+1
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,4 @@ github.com/xeipuuv/gojsonpointer e0fe6f68307607d540ed8eac07a342c33fa1b54a
142142
github.com/xeipuuv/gojsonreference e02fc20de94c78484cd5ffb007f8af96be030a45
143143
github.com/xeipuuv/gojsonschema 93e72a773fade158921402d6a24c819b48aba29d
144144
gopkg.in/yaml.v2 4c78c975fe7c825c6d1466c42be594d1d6f3aba6
145+
github.com/opencontainers/selinux ba1aefe8057f1d0cfb8e88d0ec1dc85925ef987d

0 commit comments

Comments
 (0)