From: Dan Walsh <dwalsh@redhat.com> Currently the /proc/meminfo is labeled fusefs_t rather then proc_t. SELinux blocks openshift instances from reading fusefs_t, this patch sets the file to the default label of /proc/meminfo --- .gnulib | 2 +- src/lxc/lxc_container.c | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/.gnulib b/.gnulib index 92f3a4c..819b1c3 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 92f3a4c8e52e64c233e260431d095dbf88554c14 +Subproject commit 819b1c38b9abd94d7d1ca2a77bbe16053b75029c diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index ac0f69c..854a9ef 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -52,6 +52,10 @@ # include <blkid/blkid.h> #endif +#if WITH_SELINUX +# include <selinux/selinux.h> +#endif + #include "virerror.h" #include "virlog.h" #include "lxc_container.h" @@ -763,6 +767,27 @@ static int lxcContainerMountProcFuse(virDomainDefPtr def, def->name)) < 0) return ret; +#if WITH_SELINUX + if (is_selinux_enabled() > 0) + { + security_context_t scon; + ret = getfilecon("/proc/meminfo", &scon); + if (ret) { + virReportSystemError(errno, + _("Failed to get security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + ret = setfilecon(meminfo_path,scon); + freecon(scon); + if (ret) { + virReportSystemError(errno, + _("Failed to set security context of %s for /proc/meminfo mount point"), + meminfo_path); + return ret; + } + } +#endif if ((ret = mount(meminfo_path, "/proc/meminfo", NULL, MS_BIND, NULL)) < 0) { virReportSystemError(errno, -- 1.8.2