-
Notifications
You must be signed in to change notification settings - Fork 63
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Inside a container selinux.Chcon fails although chcon command succeeds in applying a SELinux context #215
Comments
I do not know what label is being set, which could cause that error. I opened I would think this is something to do with SELinux failing to get the correct label when run within a container, but I am not sure. |
Thank you @rhatdan. I've applied the patch and the error message I'm now getting is lsetxattr(label=container_file_t) /mps/nvidia.com/gpu/pipe: invalid argument |
Try |
Thanks @rhatdan, it worked! Why is the discrepancy between the API and command? Should I read the full context first, then modify the type and write the context back? This is what |
An SELinux label is "system_u:object_r:container_file_t:s0" not "container_file_t" When dealing with labels the use of container_file_t as the type, is expanded to the full SELinux label based on the process setting the label. ps -eZ | grep podman Setting the container_file_t would become
Thus the SELinux User the Role object_r is because file types do not have roles. so we hard code |
When executed inside a container, the following code
fails for me with
lsetxattr /mps/nvidia.com/gpu/pipe: invalid argument
However, this code runs without errors and successfully updates the SELinux type:
The container is running privileged on OpenShift (RHCOS).
The text was updated successfully, but these errors were encountered: