Skip to content

Commit a41213f

Browse files
crosbymichaelsamuelkarp
crosbymichael
and
samuelkarp
committed
only relabel cri managed host mounts
Co-authored-by: Samuel Karp <[email protected]> Signed-off-by: Michael Crosby <[email protected]> Signed-off-by: Samuel Karp <[email protected]> (cherry picked from commit 9b03039) Signed-off-by: Samuel Karp <[email protected]>
1 parent 312af27 commit a41213f

File tree

3 files changed

+57
-67
lines changed

3 files changed

+57
-67
lines changed

‎pkg/cri/opts/spec_linux.go‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -225,30 +225,6 @@ func WithMounts(osi osinterface.OS, config *runtime.ContainerConfig, extra []*ru
225225
}
226226
}
227227

228-
const (
229-
etcHosts = "/etc/hosts"
230-
etcHostname = "/etc/hostname"
231-
resolvConfPath = "/etc/resolv.conf"
232-
)
233-
234-
// WithRelabeledContainerMounts relabels the default container mounts for files in /etc
235-
func WithRelabeledContainerMounts(mountLabel string) oci.SpecOpts {
236-
return func(ctx context.Context, client oci.Client, _ *containers.Container, s *runtimespec.Spec) (err error) {
237-
if mountLabel == "" {
238-
return nil
239-
}
240-
for _, m := range s.Mounts {
241-
switch m.Destination {
242-
case etcHosts, etcHostname, resolvConfPath:
243-
if err := label.Relabel(m.Source, mountLabel, false); err != nil {
244-
return err
245-
}
246-
}
247-
}
248-
return nil
249-
}
250-
}
251-
252228
// Ensure mount point on which path is mounted, is shared.
253229
func ensureShared(path string, lookupMount func(string) (mount.Info, error)) error {
254230
mountInfo, err := lookupMount(path)

‎pkg/cri/server/container_create_linux.go‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -68,28 +68,31 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
6868
hostpath := c.getSandboxHostname(sandboxID)
6969
if _, err := c.os.Stat(hostpath); err == nil {
7070
mounts = append(mounts, &runtime.Mount{
71-
ContainerPath: etcHostname,
72-
HostPath: hostpath,
73-
Readonly: securityContext.GetReadonlyRootfs(),
71+
ContainerPath: etcHostname,
72+
HostPath: hostpath,
73+
Readonly: securityContext.GetReadonlyRootfs(),
74+
SelinuxRelabel: true,
7475
})
7576
}
7677
}
7778

7879
if !isInCRIMounts(etcHosts, config.GetMounts()) {
7980
mounts = append(mounts, &runtime.Mount{
80-
ContainerPath: etcHosts,
81-
HostPath: c.getSandboxHosts(sandboxID),
82-
Readonly: securityContext.GetReadonlyRootfs(),
81+
ContainerPath: etcHosts,
82+
HostPath: c.getSandboxHosts(sandboxID),
83+
Readonly: securityContext.GetReadonlyRootfs(),
84+
SelinuxRelabel: true,
8385
})
8486
}
8587

8688
// Mount sandbox resolv.config.
8789
// TODO: Need to figure out whether we should always mount it as read-only
8890
if !isInCRIMounts(resolvConfPath, config.GetMounts()) {
8991
mounts = append(mounts, &runtime.Mount{
90-
ContainerPath: resolvConfPath,
91-
HostPath: c.getResolvPath(sandboxID),
92-
Readonly: securityContext.GetReadonlyRootfs(),
92+
ContainerPath: resolvConfPath,
93+
HostPath: c.getResolvPath(sandboxID),
94+
Readonly: securityContext.GetReadonlyRootfs(),
95+
SelinuxRelabel: true,
9396
})
9497
}
9598

@@ -192,7 +195,7 @@ func (c *criService) containerSpec(
192195
}
193196
}()
194197

195-
specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel), customopts.WithRelabeledContainerMounts(mountLabel))
198+
specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel))
196199

197200
if !c.config.DisableProcMount {
198201
// Change the default masked/readonly paths to empty slices

‎pkg/cri/server/container_create_linux_test.go‎

Lines changed: 44 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -450,19 +450,22 @@ func TestContainerMounts(t *testing.T) {
450450
},
451451
expectedMounts: []*runtime.Mount{
452452
{
453-
ContainerPath: "/etc/hostname",
454-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
455-
Readonly: true,
453+
ContainerPath: "/etc/hostname",
454+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
455+
Readonly: true,
456+
SelinuxRelabel: true,
456457
},
457458
{
458-
ContainerPath: "/etc/hosts",
459-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
460-
Readonly: true,
459+
ContainerPath: "/etc/hosts",
460+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
461+
Readonly: true,
462+
SelinuxRelabel: true,
461463
},
462464
{
463-
ContainerPath: resolvConfPath,
464-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
465-
Readonly: true,
465+
ContainerPath: resolvConfPath,
466+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
467+
Readonly: true,
468+
SelinuxRelabel: true,
466469
},
467470
{
468471
ContainerPath: "/dev/shm",
@@ -476,19 +479,22 @@ func TestContainerMounts(t *testing.T) {
476479
securityContext: &runtime.LinuxContainerSecurityContext{},
477480
expectedMounts: []*runtime.Mount{
478481
{
479-
ContainerPath: "/etc/hostname",
480-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
481-
Readonly: false,
482+
ContainerPath: "/etc/hostname",
483+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
484+
Readonly: false,
485+
SelinuxRelabel: true,
482486
},
483487
{
484-
ContainerPath: "/etc/hosts",
485-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
486-
Readonly: false,
488+
ContainerPath: "/etc/hosts",
489+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
490+
Readonly: false,
491+
SelinuxRelabel: true,
487492
},
488493
{
489-
ContainerPath: resolvConfPath,
490-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
491-
Readonly: false,
494+
ContainerPath: resolvConfPath,
495+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
496+
Readonly: false,
497+
SelinuxRelabel: true,
492498
},
493499
{
494500
ContainerPath: "/dev/shm",
@@ -504,19 +510,22 @@ func TestContainerMounts(t *testing.T) {
504510
},
505511
expectedMounts: []*runtime.Mount{
506512
{
507-
ContainerPath: "/etc/hostname",
508-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
509-
Readonly: false,
513+
ContainerPath: "/etc/hostname",
514+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
515+
Readonly: false,
516+
SelinuxRelabel: true,
510517
},
511518
{
512-
ContainerPath: "/etc/hosts",
513-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
514-
Readonly: false,
519+
ContainerPath: "/etc/hosts",
520+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
521+
Readonly: false,
522+
SelinuxRelabel: true,
515523
},
516524
{
517-
ContainerPath: resolvConfPath,
518-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
519-
Readonly: false,
525+
ContainerPath: resolvConfPath,
526+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
527+
Readonly: false,
528+
SelinuxRelabel: true,
520529
},
521530
{
522531
ContainerPath: "/dev/shm",
@@ -555,14 +564,16 @@ func TestContainerMounts(t *testing.T) {
555564
securityContext: &runtime.LinuxContainerSecurityContext{},
556565
expectedMounts: []*runtime.Mount{
557566
{
558-
ContainerPath: "/etc/hosts",
559-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
560-
Readonly: false,
567+
ContainerPath: "/etc/hosts",
568+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
569+
Readonly: false,
570+
SelinuxRelabel: true,
561571
},
562572
{
563-
ContainerPath: resolvConfPath,
564-
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
565-
Readonly: false,
573+
ContainerPath: resolvConfPath,
574+
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
575+
Readonly: false,
576+
SelinuxRelabel: true,
566577
},
567578
{
568579
ContainerPath: "/dev/shm",

0 commit comments

Comments
 (0)