| Message ID | 28469d0fea059a51694c6fa3b5bd3971696a4f13.1605636800.git.edvin.torok@citrix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | tools/ocaml/libs/xc: domid control at domain creation time | expand |
On 11/17/20 12:24 PM, Edwin Török wrote: > On CentOS 8 with SELinux containerize doesn't work at all: > > Make sure that the source code and SSH agent directories are passed on > with SELinux relabeling enabled. > (`-security-opt label=disabled` would be another option) > > Signed-off-by: Edwin Török <edvin.torok@citrix.com> Looks reasonable. Acked-by: Doug Goldstein <cardoe@cardoe.com>
diff --git a/automation/scripts/containerize b/automation/scripts/containerize index a75d54566c..ed991bb79c 100755 --- a/automation/scripts/containerize +++ b/automation/scripts/containerize @@ -7,7 +7,7 @@ # and /etc/subgid. # docker_cmd=${DOCKER_CMD:-"docker"} -[ "$DOCKER_CMD" = "podman" ] && userns_podman="--userns=keep-id" +[ "$DOCKER_CMD" = "podman" ] && userns_podman="--userns=keep-id" selinux=",z" einfo() { echo "$*" >&2 @@ -95,9 +95,9 @@ einfo "*** Launching container ..." exec ${docker_cmd} run \ ${userarg} \ ${SSH_AUTH_SOCK:+-e SSH_AUTH_SOCK="/tmp/ssh-agent/${SSH_AUTH_NAME}"} \ - -v "${CONTAINER_PATH}":/build:rw \ + -v "${CONTAINER_PATH}":/build:rw${selinux} \ -v "${HOME}/.ssh":/root/.ssh:ro \ - ${SSH_AUTH_DIR:+-v "${SSH_AUTH_DIR}":/tmp/ssh-agent} \ + ${SSH_AUTH_DIR:+-v "${SSH_AUTH_DIR}":/tmp/ssh-agent${selinux}} \ ${XEN_CONFIG_EXPERT:+-e XEN_CONFIG_EXPERT=${XEN_CONFIG_EXPERT}} \ ${CONTAINER_ARGS} \ -${termint}i --rm -- \
On CentOS 8 with SELinux containerize doesn't work at all: Make sure that the source code and SSH agent directories are passed on with SELinux relabeling enabled. (`-security-opt label=disabled` would be another option) Signed-off-by: Edwin Török <edvin.torok@citrix.com> --- automation/scripts/containerize | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)