feature: support selinux #4639
Open
feature: support selinux #4639
+179
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ningmingxiao
force-pushed
the
selinux_support
branch
7 times, most recently
from
d69b7e0 to
2eaa687
Compare
ningmingxiao
changed the title
ningmingxiao
force-pushed
the
selinux_support
branch
from
2eaa687 to
1e356d6
Compare
This was referenced Dec 6, 2025
ningmingxiao
force-pushed
the
selinux_support
branch
from
1e356d6 to
56a8926
Compare
AkihiroSuda
reviewed
Dec 8, 2025
AkihiroSuda
reviewed
Dec 8, 2025
AkihiroSuda
reviewed
Dec 8, 2025
AkihiroSuda
reviewed
Dec 8, 2025
AkihiroSuda
reviewed
Dec 8, 2025
AkihiroSuda
reviewed
Dec 8, 2025
AkihiroSuda
reviewed
Dec 8, 2025
AkihiroSuda
reviewed
Dec 8, 2025
| if err != nil { | ||
| output := strings.TrimSpace(string(stdout)) | ||
| if strings.Contains(output, "container_t") { | ||
| t.Fatal(fmt.Errorf("expect label container_t but get %s", output)) |
Member
There was a problem hiding this comment.
The uniqueness of the MCS categories have to be checked too?
Contributor
Author
There was a problem hiding this comment.
what do you think how to check? @AkihiroSuda
AkihiroSuda
reviewed
Dec 8, 2025
| - :nerd_face: `--host-gateway-ip`: IP address that the special 'host-gateway' string in --add-host resolves to. It has no effect without setting --add-host | ||
| - Default: the IP address of the host | ||
| - :nerd_face: `--userns-remap=<username>:<groupname>`: Support idmapping of containers. This options is only supported on rootful linux for container create and run if a user name and optionally group name is passed, it does idmapping based on the uidmap and gidmap ranges specified in /etc/subuid and /etc/subgid respectively. Note: `--userns-remap` is not supported for building containers. Nerdctl Build doesn't support userns-remap feature. (format: <name|uid>[:<group|gid>]) | ||
| - :nerd_face: `--selinux-enabled`: Enable selinux support |
Member
There was a problem hiding this comment.
https://github.com/containerd/nerdctl/blob/main/docs/config.md needs to be updated too
ningmingxiao
force-pushed
the
selinux_support
branch
from
56a8926 to
a210aa3
Compare
ningmingxiao
force-pushed
the
selinux_support
branch
4 times, most recently
from
0077439 to
ec3feb9
Compare
Signed-off-by: ningmingxiao <[email protected]>
ningmingxiao
force-pushed
the
selinux_support
branch
from
ec3feb9 to
977dba6
Compare
AkihiroSuda
reviewed
Dec 11, 2025
| selinux_enabled= true | ||
| ``` | ||
|
|
||
| ## Properties |
AkihiroSuda
reviewed
Dec 11, 2025
| }, | ||
| } | ||
|
|
||
| // NoSexlinux marks a test as suitable only for the noselinux enable environment |
AkihiroSuda
reviewed
Dec 11, 2025
|
|
||
| func TestRunSelinuxWithSecurityOpt(t *testing.T) { | ||
| testCase := nerdtest.Setup() | ||
| testCase.Require = require.Not(nerdtest.NoSelinux) |
Member
There was a problem hiding this comment.
Why not
Suggested change
| testCase.Require = require.Not(nerdtest.NoSelinux) | |
| testCase.Require = nerdtest.SELinux |
Member
There was a problem hiding this comment.
The test has to be skipped on Docker, as Docker lacks --selinux-enabled on the client side
AkihiroSuda
reviewed
Dec 11, 2025
| { | ||
| Description: "test run with selinux-enabled", | ||
| Command: func(data test.Data, helpers test.Helpers) test.TestableCommand { | ||
| return helpers.Command("--selinux-enabled", "run", "-d", "-v", fmt.Sprintf("/%s:/%s:Z", testContainer, testContainer), "--name", testContainer, "sleep", "infinity") |
Member
There was a problem hiding this comment.
lower z should be tested too
https://docs.docker.com/engine/storage/bind-mounts/#configure-the-selinux-label
The z option indicates that the bind mount content is shared among multiple containers.
The Z option indicates that the bind mount content is private and unshared.
This should be verified by launching multiple containers
AkihiroSuda
reviewed
Dec 11, 2025
| case "Z", "z": | ||
| specOpts = append(specOpts, func(ctx context.Context, cli oci.Client, c *containers.Container, s *oci.Spec) error { | ||
| if s.Linux != nil && s.Linux.MountLabel != "" { | ||
| if err := label.Relabel(src, s.Linux.MountLabel, strings.Contains(opt, "z")); err != nil { |
Member
There was a problem hiding this comment.
Suggested change
| if err := label.Relabel(src, s.Linux.MountLabel, strings.Contains(opt, "z")); err != nil { | |
| if err := label.Relabel(src, s.Linux.MountLabel, opt == "z"); err != nil { |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
ping @AkihiroSuda