From 9da452cca1b66c1a0e76334b88f16a4045902573 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Tue, 1 Apr 2014 09:24:24 -0400 Subject: [PATCH] Remove hard coding of SELinux labels on systems without proper selinux policy. If a system is configured for SELinux but does not know about docker or containers, then we want the transitions of the policy to work. Hard coding the labels causes docker to break on older Fedora and RHEL systems Docker-DCO-1.1-Signed-off-by: Dan Walsh (github: rhatdan) Upstream-commit: f9b8161c60f58d383ca0eaf5a99865b83e4a41b8 Component: engine --- components/engine/pkg/selinux/selinux.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/components/engine/pkg/selinux/selinux.go b/components/engine/pkg/selinux/selinux.go index 5236d3fb87..6453f37ea9 100644 --- a/components/engine/pkg/selinux/selinux.go +++ b/components/engine/pkg/selinux/selinux.go @@ -313,12 +313,9 @@ func GetLxcContexts() (processLabel string, fileLabel string) { return "", "" } lxcPath := fmt.Sprintf("%s/content/lxc_contexts", GetSELinuxPolicyRoot()) - fileLabel = "system_u:object_r:svirt_sandbox_file_t:s0" - processLabel = "system_u:system_r:svirt_lxc_net_t:s0" - in, err := os.Open(lxcPath) if err != nil { - goto exit + return "", "" } defer in.Close() @@ -352,6 +349,11 @@ func GetLxcContexts() (processLabel string, fileLabel string) { } } } + + if processLabel == "" || fileLabel == "" { + return "", "" + } + exit: mcs := IntToMcs(os.Getpid(), 1024) scon := NewContext(processLabel)