-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
merge #4053 into opencontainers/runc:main
Kir Kolyshkin (3): Add dmz-vs-selinux kludge and a way to disable it README: fix reference to memfd-bind tests/int: add selinux test case LGTMs: AkihiroSuda cyphar
- Loading branch information
Showing
8 changed files
with
134 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| //go:build runc_dmz_selinux_nocompat || !linux | ||
|
|
||
| package dmz | ||
|
|
||
| import "github.com/opencontainers/runc/libcontainer/configs" | ||
|
|
||
| // WorksWithSELinux tells whether runc-dmz can work with SELinux. | ||
| func WorksWithSELinux(*configs.Config) bool { | ||
| return true | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| //go:build linux && !runc_dmz_selinux_nocompat | ||
|
|
||
| package dmz | ||
|
|
||
| import ( | ||
| "github.com/opencontainers/runc/libcontainer/configs" | ||
| "github.com/opencontainers/selinux/go-selinux" | ||
| ) | ||
|
|
||
| // WorksWithSELinux tells whether runc-dmz can work with SELinux. | ||
| // | ||
| // Older SELinux policy can prevent runc to execute the dmz binary. The issue is | ||
| // fixed in container-selinux >= 2.224.0: | ||
| // | ||
| // - https://github.com/containers/container-selinux/issues/274 | ||
| // - https://github.com/containers/container-selinux/pull/280 | ||
| // | ||
| // Alas, there is is no easy way to do a runtime check if dmz works with | ||
| // SELinux, so the below workaround is enabled by default. It results in | ||
| // disabling dmz in case container SELinux label is set and the selinux is in | ||
| // enforced mode. | ||
| // | ||
| // Newer distributions that have the sufficiently new container-selinux version | ||
| // can build runc with runc_dmz_selinux_nocompat build flag to disable this | ||
| // workaround (essentially allowing dmz to be used together with SELinux). | ||
| func WorksWithSELinux(c *configs.Config) bool { | ||
| return c.ProcessLabel == "" || selinux.EnforceMode() != selinux.Enforcing | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| #!/usr/bin/env bats | ||
|
|
||
| load helpers | ||
|
|
||
| function setup() { | ||
| requires root # for chcon | ||
| if ! selinuxenabled; then | ||
| skip "requires SELinux enabled and in enforcing mode" | ||
| fi | ||
|
|
||
| setup_busybox | ||
|
|
||
| # Use a copy of runc binary with proper selinux label set. | ||
| cp "$RUNC" . | ||
| export RUNC="$PWD/runc" | ||
| chcon -u system_u -r object_r -t container_runtime_exec_t "$RUNC" | ||
|
|
||
| # Label container fs. | ||
| chcon -u system_u -r object_r -t container_file_t -R rootfs | ||
|
|
||
| # Save the start date and time for ausearch. | ||
| AU_DD="$(date +%x)" | ||
| AU_TT="$(date +%H:%M:%S)" | ||
| } | ||
|
|
||
| function teardown() { | ||
| teardown_bundle | ||
| # Show any avc denials. | ||
| if [[ -v AU_DD && -v AU_TT ]] && command -v ausearch &>/dev/null; then | ||
| ausearch -ts "$AU_DD" "$AU_TT" -i -m avc || true | ||
| fi | ||
| } | ||
|
|
||
| # Baseline test, to check that runc works with selinux enabled. | ||
| @test "runc run (no selinux label)" { | ||
| update_config ' .process.args = ["/bin/true"]' | ||
| runc run tst | ||
| [ "$status" -eq 0 ] | ||
| } | ||
|
|
||
| # https://github.com/opencontainers/runc/issues/4057 | ||
| @test "runc run (custom selinux label)" { | ||
| update_config ' .process.selinuxLabel |= "system_u:system_r:container_t:s0:c4,c5" | ||
| | .process.args = ["/bin/true"]' | ||
| runc run tst | ||
| [ "$status" -eq 0 ] | ||
| } | ||
|
|
||
| @test "runc run (custom selinux label, RUNC_DMZ=legacy)" { | ||
| export RUNC_DMZ=legacy | ||
| update_config ' .process.selinuxLabel |= "system_u:system_r:container_t:s0:c4,c5" | ||
| | .process.args = ["/bin/true"]' | ||
| runc run tst | ||
| [ "$status" -eq 0 ] | ||
| } |