Commit Graph

7 Commits

Author SHA1 Message Date
Paul Holzinger a1715cc863
replace deprecated selinux/label calls
These functions were removed in github.com/opencontainers/selinux
v1.12.0.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2025-03-24 13:32:00 +01:00
Kir Kolyshkin 24da18800e *: fix build tags
This change is generated by `go1.23rc2 fix ./...`.

Had to use go1.23rc2, since all released go versions have a bug
preventing it from working with `go 1.22.0` in go.mod (opened
https://github.com/golang/go/issues/68825,
https://github.com/golang/go/issues/68824 for awareness).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2024-08-09 17:05:30 -07:00
Daniel J Walsh 8d5d763213
Fix stutters
Podman adds an Error: to every error message. So starting an error
message with "error" ends up being reported to the user as

Error: error ...

This patch removes the stutter.

Also ioutil.ReadFile errors report the Path, so wrapping the err message
with the path causes a stutter.

Signed-off-by: Daniel J Walsh dwalsh@redhat.com

[NO NEW TESTS NEEDED]

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2022-09-19 07:11:44 -04:00
Sascha Grunert ce384684c0
Switch to golang native error wrapping
We now use the golang error wrapping format specifier `%w` instead of
the deprecated github.com/pkg/errors package.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
2022-07-07 11:41:47 +02:00
Daniel J Walsh 580356f0c3
SELinux no longer requires a tag.
It should work fine on linux and not linux boxes. Since there
is no glibc added, we can safely compile and run this code
on non SELinux boxes.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2020-12-21 15:24:28 -05:00
Nalin Dahyabhai 0160a7757b run: check if SELinux is enabled
When we're built with support for SELinux, refrain from setting process
and mount labels if SELinux isn't detected as enabled at runtime.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>

Closes: #1542
Approved by: rhatdan
2019-04-25 17:50:11 +00:00
Nalin Dahyabhai 38ef1231f2 Add and implement IsolationChroot
Add an IsolationChroot that trades flexibility and isolation for being
able to do what it does in a host environment that's already isolated to
the point where we're not allowed to set up some of that isolation,
producing a result that leans more toward chroot(1) than runc(1) does.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>

Closes: #836
Approved by: rhatdan
2018-08-01 14:04:59 +00:00