mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-10 21:53:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Allow restoring with a different LSM profile

Browse Source 
Restoring an SELinux enabled container with Podman will result in
a container with the exactly same SELinux process labels as during
checkpointing. CRIU takes care of all the process labels.

Restoring multiple copies of a checkpointed container will result in all
containers having the same SELinux process labels, which might be
undesired.

When looking at Pods all container in a Pod share the process label
of the infrastructure container. To restore a container into and
existing Pod it is necessary to tell CRIU to restore the container
with the infrastructure container process label.

CRIU supports setting different process labels using --lsm-profile for a
long time and this just passes the process label information from runc
to CRIU.

Unfortunately CRIU has a bug as no one was using the --lsm-profile
option so this changes requires the upcoming CRIU version 3.16.

Signed-off-by: Adrian Reber <areber@redhat.com>
This commit is contained in:
Adrian Reber
2021-06-07 15:44:44 +00:00
parent 2f8e8e9d97
commit 535f25c44f
4 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/runc-restore.8.md
+16
View File
@@ -26,3 +26,19 @@ using the runc checkpoint command.
--pid-file value specify the file to write the process id to
--no-subreaper disable the use of the subreaper used to reap reparented processes
--no-pivot do not use pivot root to jail process inside rootfs. This should be used whenever the rootfs is on top of a ramdisk
--empty-ns value create a namespace, but don't restore its properties
--auto-dedup enable auto deduplication of memory images
--lazy-pages use userfaultfd to lazily restore memory pages
--lsm-profile value Specify an LSM profile to be used during restore in the form of TYPE:NAME.
## OPTION DETAILS
**--lsm-profile**
Specify an LSM profile to be used during restore in the form of TYPE:NAME.
`TYPE` can either be *apparamor* or *selinux* and is followed by *:* and a
valid LSM label.
```
runc restore --lsm-profile "selinux:system_u:system_r:container_t:s0:c82,c137" <container-id>
```