Add support for selinux in verbose bind mount specification #911
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This corresponds to specifying the `z` or `Z` option in the third portion of a terse mount specification (i.e. src:trg:z) Signed-off-by: charliemirabile <46761267+charliemirabile@users.noreply.github.com>
based on seccomp test. Without the selinux option, visiting localhost:8080 will give a 404 error because httpd cannot access the file, but with selinux: z the context for the file will be appropriately updated so httpd can access it Signed-off-by: charliemirabile <46761267+charliemirabile@users.noreply.github.com>
p12tic
reviewed
Apr 17, 2024
| @@ -431,6 +431,11 @@ def mount_desc_to_mount_args(compose, mount_desc, srv_name, cnt_name): # pylint | |||
| tmpfs_mode = tmpfs_opts.get("mode", None) | |||
| if tmpfs_mode: | |||
| opts.append(f"tmpfs-mode={tmpfs_mode}") | |||
| if mount_type == "bind": | |||
There was a problem hiding this comment.
We should add a test for the function this code lives in in pytests/
p12tic
reviewed
Apr 17, 2024
| @@ -486,6 +491,12 @@ def mount_desc_to_volume_args(compose, mount_desc, srv_name, cnt_name): # pylin | |||
| read_only = mount_desc.get("read_only", None) | |||
| if read_only is not None: | |||
| opts.append("ro" if read_only else "rw") | |||
| if mount_type == "bind": | |||
There was a problem hiding this comment.
We should add a test for the function this code lives in in pytests/
p12tic
requested changes
Apr 17, 2024
|
@muayyad-alsadi Please don't merge PRs that have unaddressed concerns raised |
charliemirabile
added a commit
to charliemirabile/podman-compose
that referenced
this pull request
May 21, 2024
Support for setting the selinux flags on a bind mount specified using the verbose syntax was merged as part of containers#911, but at that time the PR lacked unit tests. This commit adds the missing tests Signed-off-by: charliemirabile <46761267+charliemirabile@users.noreply.github.com>
charliemirabile
added a commit
to charliemirabile/podman-compose
that referenced
this pull request
May 21, 2024
Support for setting the selinux flags on a bind mount specified using the verbose syntax was merged as part of containers#911, but at that time the PR lacked unit tests. This commit adds the missing tests Signed-off-by: charliemirabile <46761267+charliemirabile@users.noreply.github.com>
Merged
charliemirabile
added a commit
to charliemirabile/podman-compose
that referenced
this pull request
May 21, 2024
Support for setting the selinux flags on a bind mount specified using the verbose syntax was merged as part of containers#911, but at that time the PR lacked unit tests. This commit adds the missing tests Signed-off-by: charliemirabile <46761267+charliemirabile@users.noreply.github.com>
charliemirabile
added a commit
to charliemirabile/podman-compose
that referenced
this pull request
May 21, 2024
Support for setting the selinux flags on a bind mount specified using the verbose syntax was merged as part of containers#911, but at that time the PR lacked unit tests. This commit adds the missing tests Signed-off-by: charliemirabile <46761267+charliemirabile@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As specified here in the compose schema: https://github.com/compose-spec/compose-spec/blob/c35d19323fdfd7dbf9db30022498e29ef5ebeab2/schema/compose-spec.json#L382-L388
and described here in the compose spec: https://github.com/compose-spec/compose-spec/blob/master/05-services.md#long-syntax-5
it should be possible to specify selinux relabeling for a bind mount specified using the verbose syntax (as opposed to the terse syntax which already works). This PR adds support for this syntax in podman compose to achieve parity with docker compose in this area.