Merge pull request #1514 from rhatdan/selinux

vrothberg · web-flow · commit 01edf7e35f1a · 2023-02-23T14:12:10.000+01:00
Don't hard code SELinux labels into code
diff --git a/drivers/overlay/overlay.go b/drivers/overlay/overlay.go
@@ -47,8 +47,7 @@ var (
 )
 
 const (
-	defaultPerms     = os.FileMode(0555)
-	selinuxLabelTest = "system_u:object_r:container_file_t:s0"
+	defaultPerms = os.FileMode(0555)
 )
 
 // This backend uses the overlay union filesystem for containers
@@ -657,6 +656,8 @@ func SupportsNativeOverlay(home, runhome string) (bool, error) {
 func supportsOverlay(home string, homeMagic graphdriver.FsMagic, rootUID, rootGID int) (supportsDType bool, err error) {
 	// We can try to modprobe overlay first
 
+	selinuxLabelTest := selinux.PrivContainerMountLabel()
+
 	exec.Command("modprobe", "overlay").Run()
 
 	logLevel := logrus.ErrorLevel

Original file line number	Diff line number	Diff line change
`@@ -47,8 +47,7 @@ var (`
`47`	`47`	`)`
`48`	`48`
`49`	`49`	`const (`
`50`		`- defaultPerms = os.FileMode(0555)`
`51`		`- selinuxLabelTest = "system_u:object_r:container_file_t:s0"`
	`50`	`+ defaultPerms = os.FileMode(0555)`
`52`	`51`	`)`
`53`	`52`
`54`	`53`	`// This backend uses the overlay union filesystem for containers`
`@@ -657,6 +656,8 @@ func SupportsNativeOverlay(home, runhome string) (bool, error) {`
`657`	`656`	`func supportsOverlay(home string, homeMagic graphdriver.FsMagic, rootUID, rootGID int) (supportsDType bool, err error) {`
`658`	`657`	`// We can try to modprobe overlay first`
`659`	`658`
	`659`	`+ selinuxLabelTest := selinux.PrivContainerMountLabel()`
	`660`	`+`
`660`	`661`	`exec.Command("modprobe", "overlay").Run()`
`661`	`662`
`662`	`663`	`logLevel := logrus.ErrorLevel`