beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

daemon: relabel secrets path

Browse source 
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
(cherry picked from commit b11af7b2f6)
Signed-off-by: Victor Vieux <victorvieux@gmail.com>
This commit is contained in:
Antonio Murdaca 2017-04-11 17:43:23 +02:00 committed by Victor Vieux
parent aea00bf675
commit df996a9581
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
daemon/container_operations_unix.go
View file

@ -214,6 +214,8 @@ func (daemon *Daemon) setupSecretDir(c *container.Container) (setupErr error) {
}
}
label.Relabel(localMountPath, c.MountLabel, false)
// remount secrets ro
if err := mount.Mount("tmpfs", localMountPath, "tmpfs", "remount,ro,"+tmpfsOwnership); err != nil {
return errors.Wrap(err, "unable to remount secret dir as readonly")