-
Notifications
You must be signed in to change notification settings - Fork 365
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix SELinux labels to allow shared use. #962
Conversation
Ensure that the volumes are not mounted as private, unshared volumes since we might mount with the host filesystem. This also fixes permissions issues with reading data from a mounted volume using a rootless container engine.
You can test the logic behind this with the following (use Fedora since it comes with SELinux enforced by default): $ getenforce
Enforcing
# no label
$ podman run -it --rm -v "$PWD":"$PWD" -w "$PWD" ubuntu:20.04 bash -c "ls"
ls: cannot open directory '.': Permission denied
$ podman run -it --rm -v "$PWD":"$PWD":z -w "$PWD" ubuntu:20.04 bash -c "ls"
Cargo.lock Cargo.toml src target
$ podman run -it --rm -v "$PWD":"$PWD":Z -w "$PWD" ubuntu:20.04 bash -c "ls"
Cargo.lock Cargo.toml src target Note that once the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
bors r+
Build succeeded: |
Hi, I was wondering, is it worth to have have a release that includes this fix? Like together with other fixes from |
Sorry for the lack of response, I want to do this but haven't taken the time to do so. I'm not sure what else we should include in v0.2.5 but just this. I'll make the release tomorrow |
1201: Release v0.2.5 r=Emilgardis a=Emilgardis See #962 (comment) includes ee3c972 #962 fc3df66 #1166 33ee940 in #997 81c1e59 #950 6a57d01 #1183 Co-authored-by: Emil Gardström <emil.gardstrom@gmail.com> Co-authored-by: Alex Huszagh <ahuszagh@gmail.com> Co-authored-by: Taiki Endo <te316e89@gmail.com>
1201: Release v0.2.5 r=Emilgardis a=Emilgardis See #962 (comment) includes ee3c972 #962 fc3df66 #1166 33ee940 in #997 81c1e59 #950 6a57d01 #1183 Co-authored-by: Emil Gardström <emil.gardstrom@gmail.com> Co-authored-by: Alex Huszagh <ahuszagh@gmail.com> Co-authored-by: Taiki Endo <te316e89@gmail.com>
hi, @Emilgardis took me a while to circle back, but I just tested v0.2.5 and there seems to be a regression (i.e. aa59bf2 still works fine), but I can't reproduce it reliably though. regardless, when it happens, a permission denied error appears again. looking at the file and generated podman command, it turns out that aa59bf2 also appends |
Ensure that the volumes are not mounted as private, unshared volumes since we might mount with the host filesystem. This also fixes permissions issues with reading data from a mounted volume using a rootless container engine.
Fixes a bug introduced in #251.
Closes #961.
This is because the
Z
SELinux label assumes the data is not shared between containers and not being used by the host, as documented below:Prior to this, we used the
Z
label, when we should have been using thez
label.