From 7ca727547c4c03893beca969930a6482769c07b6 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Wed, 2 Apr 2014 13:56:30 -0400 Subject: [PATCH] Fix SELinux issue with missing Contexts in lxc execdriver There is a bug in the SELinux patch for the lxc execdriver, that causes lxc containers to blow up whether or not SELinux is enabled. Docker-DCO-1.1-Signed-off-by: Dan Walsh (github: rhatdan) Upstream-commit: ca4224762b5fe9a319b6c1724ee16d1552403269 Component: engine --- components/engine/daemonconfig/config.go | 3 +-- components/engine/runtime/execdriver/lxc/lxc_template.go | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/components/engine/daemonconfig/config.go b/components/engine/daemonconfig/config.go index 6cb3659e18..1abb6f8b89 100644 --- a/components/engine/daemonconfig/config.go +++ b/components/engine/daemonconfig/config.go @@ -1,10 +1,9 @@ package daemonconfig import ( - "net" - "github.com/dotcloud/docker/engine" "github.com/dotcloud/docker/runtime/networkdriver" + "net" ) const ( diff --git a/components/engine/runtime/execdriver/lxc/lxc_template.go b/components/engine/runtime/execdriver/lxc/lxc_template.go index f325ffcaef..83723285d0 100644 --- a/components/engine/runtime/execdriver/lxc/lxc_template.go +++ b/components/engine/runtime/execdriver/lxc/lxc_template.go @@ -32,8 +32,8 @@ lxc.pts = 1024 lxc.console = none {{if getProcessLabel .Context}} lxc.se_context = {{ getProcessLabel .Context}} -{{$MOUNTLABEL := getMountLabel .Context}} {{end}} +{{$MOUNTLABEL := getMountLabel .Context}} # no controlling tty at all lxc.tty = 1 @@ -90,8 +90,8 @@ lxc.mount.entry = sysfs {{escapeFstabSpaces $ROOTFS}}/sys sysfs nosuid,nodev,noe lxc.mount.entry = {{.Console}} {{escapeFstabSpaces $ROOTFS}}/dev/console none bind,rw 0 0 {{end}} -lxc.mount.entry = devpts {{escapeFstabSpaces $ROOTFS}}/dev/pts devpts {{formatMountLabel "newinstance,ptmxmode=0666,nosuid,noexec" "$MOUNTLABEL"}} 0 0 -lxc.mount.entry = shm {{escapeFstabSpaces $ROOTFS}}/dev/shm tmpfs {{formatMountLabel "size=65536k,nosuid,nodev,noexec" "$MOUNTLABEL"}} 0 0 +lxc.mount.entry = devpts {{escapeFstabSpaces $ROOTFS}}/dev/pts devpts {{formatMountLabel "newinstance,ptmxmode=0666,nosuid,noexec" $MOUNTLABEL}} 0 0 +lxc.mount.entry = shm {{escapeFstabSpaces $ROOTFS}}/dev/shm tmpfs {{formatMountLabel "size=65536k,nosuid,nodev,noexec" $MOUNTLABEL}} 0 0 {{range $value := .Mounts}} {{if $value.Writable}}