[Buildroot] [PATCH RFC 1/2] utils/docker-run: make it compatible with SELinux
Yann E. MORIN
yann.morin.1998 at free.fr
Wed Aug 9 21:32:45 UTC 2023
Thomas, All,
On 2023-07-26 23:20 +0200, Thomas Petazzoni via buildroot spake thusly:
> After switching to a fresh Fedora 38 installation with SELinux
> disabled, we noticed that utils/docker-run doesn't work as the
> applications running inside the container are not allowed to accept
> the data mounted through the bind mount.
>
> Turns out that Docker has a "Z" option to do the appropriate magic for
> SELinux. However, this "Z" option is only available for --volume, not
> for --mount, as explained in
> https://docs.docker.com/storage/bind-mounts/.
>
> So, this commit partially reverts 7f2020f9040f ("utils/docker-run:
> improve user experience") that switched from --volume to
> --mount. However, the justification in 7f2020f9040f to switch from
> --volume to --mount was "Docker will create the destination if it does
> not exist", but the current Docker documentation seems to say exactly
> the opposite:
>
> If you use -v or --volume to bind-mount a file or directory that
> does not yet exist on the Docker host, -v creates the endpoint for
> you. It is always created as a directory.
>
> If you use --mount to bind-mount a file or directory that does not
> yet exist on the Docker host, Docker does not automatically create
> it for you, but generates an error.
>
> Signed-off-by: Thomas Petazzoni <thomas.petazzoni at bootlin.com>
I've included this change in my respin:
https://patchwork.ozlabs.org/project/buildroot/list/?series=368134
In doing so, I switched to the proposal by Antoine, to use
--security-opt label=disable
I did not see an adverse effect on a non-SELinux host, and you reported
that it also worked for you, so let's ship it.
I've also included patch 2 in the respin.
Regards,
Yann E. MORIN.
> ---
> NOTE: I am not a Docker expert, and I certainly don't know if this is
> the right solution, and I would appreciate feedback from folks with
> more Docker experience.
> ---
> utils/docker-run | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/utils/docker-run b/utils/docker-run
> index 17c587a484..eee1aad7a4 100755
> --- a/utils/docker-run
> +++ b/utils/docker-run
> @@ -12,8 +12,8 @@ declare -a docker_opts=(
> -i
> --rm
> --user "$(id -u):$(id -g)"
> - --mount "type=bind,src=${MAIN_DIR},dst=${MAIN_DIR}"
> - --mount "type=bind,src=${GIT_DIR},dst=${GIT_DIR}"
> + --volume "${MAIN_DIR}:${MAIN_DIR}:Z"
> + --volume "${GIT_DIR}:${GIT_DIR}:Z"
> --workdir "${MAIN_DIR}"
> )
> if tty -s; then
> --
> 2.41.0
>
> _______________________________________________
> buildroot mailing list
> buildroot at buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
More information about the buildroot
mailing list