dmz: remove SELinux special-casing

Now that runc-dmz is opt-in, we no longer need to try to detect whether
SELinux would cause issues for us. We can also remove the
special-purpose build-tag we added.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
This commit is contained in:
Aleksa Sarai
2024-03-13 16:23:36 +11:00
parent 1950892f69
commit 37581ad340
10 changed files with 30 additions and 69 deletions
-4
View File
@@ -463,10 +463,6 @@ func slicesContains[S ~[]E, E comparable](slice S, needle E) bool {
}
func isDmzBinarySafe(c *configs.Config) bool {
if !dmz.WorksWithSELinux(c) {
return false
}
// Because we set the dumpable flag in nsexec, the only time when it is
// unsafe to use runc-dmz is when the container process would be able to
// race against "runc init" and bypass the ptrace_may_access() checks.