jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Mount attr and task as rw for selinux support 

Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-05-01 11:11:29 -07:00
parent df78075a8e
commit ab60f78e8b
1 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
security/restrict/restrict.go
View File

@ -28,11 +28,6 @@ func Restrict() error {
// This weird trick will allow us to mount /proc read-only, while being able to use AppArmor.
// This is because apparently, loading an AppArmor profile requires write access to /proc/1/attr.
// So we do another mount of procfs, ensure it's write-able, and bind-mount a subset of it.
var (
rwAttrPath = filepath.Join(".proc", "1", "attr")
roAttrPath = filepath.Join("proc", "1", "attr")
)
if err := os.Mkdir(".proc", 0700); err != nil {
return fmt.Errorf("unable to create temporary proc mountpoint .proc: %s", err)
}
@ -42,8 +37,10 @@ func Restrict() error {
if err := system.Mount("proc", ".proc", "", syscall.MS_REMOUNT, ""); err != nil {
return fmt.Errorf("unable to remount proc read-write: %s", err)
}
if err := system.Mount(rwAttrPath, roAttrPath, "", syscall.MS_BIND, ""); err != nil {
return fmt.Errorf("unable to bind-mount %s on %s: %s", rwAttrPath, roAttrPath, err)
for _, path := range []string{"attr", "task"} {
if err := system.Mount(filepath.Join(".proc", "1", path), filepath.Join("proc", "1", path), "", syscall.MS_BIND, ""); err != nil {
return fmt.Errorf("unable to bind-mount %s: %s", path, err)
}
}
if err := system.Unmount(".proc", 0); err != nil {
return fmt.Errorf("unable to unmount temporary proc filesystem: %s", err)