From 43aea059462a9945cfb0007dc0ca2140917e3fad Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Fri, 9 Mar 2018 14:29:06 -0500 Subject: [PATCH] Label the masked tmpfs with the mount label Currently if a confined container process tries to list these directories AVC's are generated because they are labeled with external labels. Adding the mountlabel will remove these AVC's. Signed-off-by: Daniel J Walsh --- libcontainer/rootfs_linux.go | 4 ++-- libcontainer/standard_init_linux.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 73ee2bd69..cf715d664 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -778,10 +778,10 @@ func remountReadonly(m *configs.Mount) error { // mounts ( proc/kcore ). // For files, maskPath bind mounts /dev/null over the top of the specified path. // For directories, maskPath mounts read-only tmpfs over the top of the specified path. -func maskPath(path string) error { +func maskPath(path string, mountLabel string) error { if err := unix.Mount("/dev/null", path, "", unix.MS_BIND, ""); err != nil && !os.IsNotExist(err) { if err == unix.ENOTDIR { - return unix.Mount("tmpfs", path, "tmpfs", unix.MS_RDONLY, "") + return unix.Mount("tmpfs", path, "tmpfs", unix.MS_RDONLY, label.FormatMountLabel("", mountLabel)) } return err } diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go index 02ea753ed..e74d80025 100644 --- a/libcontainer/standard_init_linux.go +++ b/libcontainer/standard_init_linux.go @@ -110,7 +110,7 @@ func (l *linuxStandardInit) Init() error { } } for _, path := range l.config.Config.MaskPaths { - if err := maskPath(path); err != nil { + if err := maskPath(path, l.config.Config.MountLabel); err != nil { return err } }