// InitLabels returns the process label and file labels to be used within // the container. A list of options can be passed into this function to alter // the labels. The labels returned will include a random MCS String, that is // guaranteed to be unique. func InitLabels(options []string) (string, string, error) { if !selinux.SelinuxEnabled() { return "", "", nil } processLabel, mountLabel := selinux.GetLxcContexts() if processLabel != "" { pcon := selinux.NewContext(processLabel) mcon := selinux.NewContext(mountLabel) for _, opt := range options { if opt == "disable" { return "", "", nil } if i := strings.Index(opt, ":"); i == -1 { return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt) } con := strings.SplitN(opt, ":", 2) if !validOptions[con[0]] { return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0]) } pcon[con[0]] = con[1] if con[0] == "level" || con[0] == "user" { mcon[con[0]] = con[1] } } processLabel = pcon.Get() mountLabel = mcon.Get() } return processLabel, mountLabel, nil }
// InitLabels returns the process label and file labels to be used within // the container. A list of options can be passed into this function to alter // the labels. The labels returned will include a random MCS String, that is // guaranteed to be unique. func InitLabels(options []string) (string, string, error) { if !selinux.SelinuxEnabled() { return "", "", nil } processLabel, mountLabel := selinux.GetLxcContexts() if processLabel != "" { pcon := selinux.NewContext(processLabel) mcon := selinux.NewContext(mountLabel) for _, opt := range options { if opt == "disable" { return "", "", nil } if i := strings.Index(opt, ":"); i == -1 { return "", "", fmt.Errorf("Bad SELinux Option") } con := strings.SplitN(opt, ":", 2) pcon[con[0]] = con[1] if con[0] == "level" || con[0] == "user" { mcon[con[0]] = con[1] } } processLabel = pcon.Get() mountLabel = mcon.Get() } return processLabel, mountLabel, nil }
// Change the label of path to the filelabel string. // It changes the MCS label to s0 if shared is true. // This will allow all containers to share the content. func Relabel(path string, fileLabel string, shared bool) error { if !selinux.SelinuxEnabled() { return nil } if fileLabel == "" { return nil } exclude_paths := map[string]bool{"/": true, "/usr": true, "/etc": true} if exclude_paths[path] { return fmt.Errorf("Relabeling of %s is not allowed", path) } if shared { c := selinux.NewContext(fileLabel) c["level"] = "s0" fileLabel = c.Get() } return selinux.Chcon(path, fileLabel, true) }
// Change the label of path to the filelabel string. If the relabel string // is "z", relabel will change the MCS label to s0. This will allow all // containers to share the content. If the relabel string is a "Z" then // the MCS label should continue to be used. SELinux will use this field // to make sure the content can not be shared by other containes. func Relabel(path string, fileLabel string, relabel string) error { exclude_path := []string{"/", "/usr", "/etc"} if fileLabel == "" { return nil } if !strings.ContainsAny(relabel, "zZ") { return nil } for _, p := range exclude_path { if path == p { return fmt.Errorf("Relabeling of %s is not allowed", path) } } if strings.Contains(relabel, "z") && strings.Contains(relabel, "Z") { return fmt.Errorf("Bad SELinux option z and Z can not be used together") } if strings.Contains(relabel, "z") { c := selinux.NewContext(fileLabel) c["level"] = "s0" fileLabel = c.Get() } return selinux.Chcon(path, fileLabel, true) }