mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
87bd784614
Add a workaround for a problem of older container-selinux not allowing runc to use dmz feature. If runc sees that SELinux is in enforced mode and the container's SELinux label is set, it disables dmz. Add a build tag, runc_dmz_selinux_nocompat, which disables the workaround. Newer distros that ship container-selinux >= 2.224.0 (currently CentOS Stream 8 and 9, RHEL 8 and 9, and Fedora 38+) may build runc with this build tag set to benefit from dmz working with SELinux. Document the build tag in the top-level and libct/dmz READMEs. Use the build tag in our CI builds for CentOS Stream 9 and Fedora 38, as they already has container-selinux 2.224.0 available in updates. Add a TODO to use the build tag for CentOS Stream 8 once it has container-selinux updated. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
11 lines
250 B
Go
11 lines
250 B
Go
//go:build runc_dmz_selinux_nocompat || !linux
|
|
|
|
package dmz
|
|
|
|
import "github.com/opencontainers/runc/libcontainer/configs"
|
|
|
|
// WorksWithSELinux tells whether runc-dmz can work with SELinux.
|
|
func WorksWithSELinux(*configs.Config) bool {
|
|
return true
|
|
}
|