jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #2031 from lifubang/selinux 

Add selinux validate in runc exec
This commit is contained in:
Michael Crosby 2019-04-03 16:09:19 -04:00 committed by GitHub
parent 6a3f4749b8 3e6688f5c9
commit 029124da7a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
exec.go
View File

@ -224,5 +224,5 @@ func getProcess(context *cli.Context, bundle string) (*specs.Process, error) {
}
p.User.AdditionalGids = append(p.User.AdditionalGids, uint32(gid))
}
return p, nil
return p, validateProcessSpec(p)
}

4
utils_linux.go
View File

@ -17,6 +17,7 @@ import (
"github.com/opencontainers/runc/libcontainer/specconv"
"github.com/opencontainers/runc/libcontainer/utils"
"github.com/opencontainers/runtime-spec/specs-go"
selinux "github.com/opencontainers/selinux/go-selinux"
"github.com/coreos/go-systemd/activation"
"github.com/pkg/errors"
@ -387,6 +388,9 @@ func validateProcessSpec(spec *specs.Process) error {
if len(spec.Args) == 0 {
return fmt.Errorf("args must not be empty")
}
if spec.SelinuxLabel != "" && !selinux.GetEnabled() {
return fmt.Errorf("selinux label is specified in config, but selinux is disabled or not supported")
}
return nil
}