1. docker
  2. Commit d00e249c26506a8e6a42b7072d80b80a5e1fbf00
Browse code

[1.13.x] bump RunC / libcontainer to fix SELinux regression

This bumps RunC and libcontainer to fix a regression
in 1.13 that caused SELinux labels to not be
applied correctly.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Sebastiaan van Stijn authored on 2017/02/02 04:36:44
Showing 3 changed files
hack/dockerfile/binaries-commits
History View file @ d00e249
... ... 
@@ -1,7 +1,9 @@
1 1 
 #!/bin/sh
2 2
3 3 
 TOMLV_COMMIT=9baf8a8a9f2ed20a8e54160840c492f937eeaf9a
4 
-RUNC_COMMIT=2f7393a47307a16f8cee44a37b262e8b81021e3e
4 
+
5 
+# When updating RUNC_COMMIT, also update runc in vendor.conf accordingly
6 
+RUNC_COMMIT=9df8b306d01f59d3a8029be411de015b7304dd8f
5 7 
 CONTAINERD_COMMIT=aa8187dbd3b7ad67d8e5e3a15115d3eef43a7ed1
6 8 
 TINI_COMMIT=949e6facb77383876aeff8a6944dde66b3089574
7 9 
 LIBNETWORK_COMMIT=0f534354b813003a754606689722fe253101bc4e
vendor.conf
History View file @ d00e249
... ... 
@@ -59,7 +59,8 @@ github.com/miekg/pkcs11 df8ae6ca730422dba20c768ff38ef7d79077a59f
59 59 
 github.com/docker/go v1.5.1-1-1-gbaf439e
60 60 
 github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c
61 61
62 
-github.com/opencontainers/runc 2f7393a47307a16f8cee44a37b262e8b81021e3e https://github.com/docker/runc.git # libcontainer
62 
+# When updating, also update RUNC_COMMIT in hack/dockerfile/binaries-commits accordingly
63 
+github.com/opencontainers/runc 9df8b306d01f59d3a8029be411de015b7304dd8f https://github.com/docker/runc.git # libcontainer
63 64 
 github.com/opencontainers/runtime-spec 1c7c27d043c2a5e513a44084d2b10d77d1402b8c # specs
64 65 
 github.com/seccomp/libseccomp-golang 32f571b70023028bd57d9288c20efbcb237f3ce0
65 66 
 # libcontainer deps (see src/github.com/opencontainers/runc/Godeps/Godeps.json)
vendor/github.com/opencontainers/runc/libcontainer/label/label_selinux.go
History View file @ d00e249
... ... 
@@ -33,19 +33,15 @@ func InitLabels(options []string) (string, string, error) {
33 33 
 		pcon := selinux.NewContext(processLabel)
34 34 
 		mcon := selinux.NewContext(mountLabel)
35 35 
 		for _, opt := range options {
36 
-			val := strings.SplitN(opt, "=", 2)
37 
-			if val[0] != "label" {
38 
-				continue
39 
-			}
40 
-			if len(val) < 2 {
41 
-				return "", "", fmt.Errorf("bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt)
42 
-			}
43 
-			if val[1] == "disable" {
36 
+			if opt == "disable" {
44 37 
 				return "", "", nil
45 38 
 			}
46 
-			con := strings.SplitN(val[1], ":", 2)
47 
-			if len(con) < 2 || !validOptions[con[0]] {
48 
-				return "", "", fmt.Errorf("bad label option %q, valid options 'disable, user, role, level, type'", con[0])
39 
+			if i := strings.Index(opt, ":"); i == -1 {
40 
+				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt)
41 
+			}
42 
+			con := strings.SplitN(opt, ":", 2)
43 
+			if !validOptions[con[0]] {
44 
+				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0])
49 45
50 46 
 			}
51 47 
 			pcon[con[0]] = con[1]