grim/convey

Automatically add the `:z` to volume mounts if selinux is enabled
redux
2021-10-11, Gary Kramlich
126c741a9abb
Parents 060f6d8b98c7
Children cf227c260992
Automatically add the `:z` to volume mounts if selinux is enabled
3 files changed, 14 insertions(+), 3 deletions(-)
  • +1 -0
    go.mod
  • +3 -2
    go.sum
  • +10 -1
    podman/run.go
    • --- a/go.mod Mon Oct 11 05:23:33 2021 -0500
    +++ b/go.mod Mon Oct 11 05:32:52 2021 -0500
    @@ -10,6 +10,7 @@
    github.com/mattn/go-zglob v0.0.3
    github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
    github.com/onsi/gomega v1.16.0
    + github.com/opencontainers/selinux v1.9.1
    github.com/sirupsen/logrus v1.8.1
    github.com/stretchr/testify v1.7.0
    golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac // indirect
    --- a/go.sum Mon Oct 11 05:23:33 2021 -0500
    +++ b/go.sum Mon Oct 11 05:32:52 2021 -0500
    @@ -53,6 +53,8 @@
    github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
    github.com/onsi/gomega v1.16.0 h1:6gjqkI8iiRHMvdccRJM8rVKjCWk6ZIm6FTm3ddIe4/c=
    github.com/onsi/gomega v1.16.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
    +github.com/opencontainers/selinux v1.9.1 h1:b4VPEF3O5JLZgdTDBmGepaaIbAo0GqoF6EBRq5f/g3Y=
    +github.com/opencontainers/selinux v1.9.1/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
    github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
    github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
    github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
    @@ -86,6 +88,7 @@
    golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
    golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
    golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
    +golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
    golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
    golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
    golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
    @@ -94,8 +97,6 @@
    golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
    golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
    golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
    -golang.org/x/sys v0.0.0-20211004093028-2c5d950f24ef h1:fPxZ3Umkct3LZ8gK9nbk+DWDJ9fstZa2grBn+lWVKPs=
    -golang.org/x/sys v0.0.0-20211004093028-2c5d950f24ef/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
    golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac h1:oN6lz7iLW/YC7un8pq+9bOLyXrprv2+DKfkJY+2LJJw=
    golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
    golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
    --- a/podman/run.go Mon Oct 11 05:23:33 2021 -0500
    +++ b/podman/run.go Mon Oct 11 05:32:52 2021 -0500
    @@ -2,6 +2,7 @@
    import (
    "github.com/kballard/go-shellquote"
    + "github.com/opencontainers/selinux/go-selinux"
    log "github.com/sirupsen/logrus"
    "keep.imfreedom.org/grim/convey/environment"
    @@ -45,11 +46,19 @@
    env["CONVEY_WORKSPACE"] = workspace
    + volume := hostWorkspace.Path() + ":" + workspace
    + if selinux.GetEnabled() {
    + // We use lower zed because it creates a shared selinux label that can
    + // be used by multiple containers and this task could be in a stage
    + // that is running tasks concurrently.
    + volume += ":z"
    + }
    +
    generator := exec.NewGenerator(
    "podman",
    "run",
    "--rm",
    - "--volume", hostWorkspace.Path()+":"+workspace,
    + "--volume", volume,
    )
    // Add any annotations that the user specified.