mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Aleksa Sarai
ed6b1693b8
Due to the sensitive nature of these fixes, it was not possible to submit these upstream and vendor the upstream library. Instead, this patch uses a fork of github.com/opencontainers/selinux, branched at commit opencontainers/selinux@879a755db5. In order to permit downstreams to build with this patched version, a snapshot of the forked version has been included in internal/third_party/selinux. Note that since we use "go mod vendor", the patched code is usable even without being "go get"-able. Once the embargo for this issue is lifted we can submit the patches upstream and switch back to a proper upstream go.mod entry. Also, this requires us to temporarily disable the CI job we have that disallows "replace" directives. Fixes: GHSA-cgrx-mc8f-2prm CVE-2025-52881 Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
49 lines
1.9 KiB
Go
49 lines
1.9 KiB
Go
package label
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/opencontainers/selinux/go-selinux"
|
|
)
|
|
|
|
// Init initialises the labeling system
|
|
func Init() {
|
|
_ = selinux.GetEnabled()
|
|
}
|
|
|
|
// FormatMountLabel returns a string to be used by the mount command. Using
|
|
// the SELinux `context` mount option. Changing labels of files on mount
|
|
// points with this option can never be changed.
|
|
// FormatMountLabel returns a string to be used by the mount command.
|
|
// The format of this string will be used to alter the labeling of the mountpoint.
|
|
// The string returned is suitable to be used as the options field of the mount command.
|
|
// If you need to have additional mount point options, you can pass them in as
|
|
// the first parameter. Second parameter is the label that you wish to apply
|
|
// to all content in the mount point.
|
|
func FormatMountLabel(src, mountLabel string) string {
|
|
return FormatMountLabelByType(src, mountLabel, "context")
|
|
}
|
|
|
|
// FormatMountLabelByType returns a string to be used by the mount command.
|
|
// Allow caller to specify the mount options. For example using the SELinux
|
|
// `fscontext` mount option would allow certain container processes to change
|
|
// labels of files created on the mount points, where as `context` option does
|
|
// not.
|
|
// FormatMountLabelByType returns a string to be used by the mount command.
|
|
// The format of this string will be used to alter the labeling of the mountpoint.
|
|
// The string returned is suitable to be used as the options field of the mount command.
|
|
// If you need to have additional mount point options, you can pass them in as
|
|
// the first parameter. Second parameter is the label that you wish to apply
|
|
// to all content in the mount point.
|
|
func FormatMountLabelByType(src, mountLabel, contextType string) string {
|
|
if mountLabel != "" {
|
|
switch src {
|
|
case "":
|
|
src = fmt.Sprintf("%s=%q", contextType, mountLabel)
|
|
default:
|
|
src = fmt.Sprintf("%s,%s=%q", src, contextType, mountLabel)
|
|
}
|
|
}
|
|
return src
|
|
}
|