1716d497a4
This change will allow us to run SELinux in a container with BTRFS back end. We continue to work on fixing the kernel/BTRFS but this change will allow SELinux Security separation on BTRFS. It basically relabels the content on container creation. Just relabling -init directory in BTRFS use case. Everything looks like it works. I don't believe tar/achive stores the SELinux labels, so we are good as far as docker commit. Tested Speed on startup with BTRFS on top of loopback directory. BTRFS not on loopback should get even better perfomance on startup time. The more inodes inside of the container image will increase the relabel time. This patch will give people who care more about security the option of runnin BTRFS with SELinux. Those who don't want to take the slow down can disable SELinux either in individual containers or for all containers by continuing to disable SELinux in the daemon. Without relabel: > time docker run --security-opt label:disable fedora echo test test real 0m0.918s user 0m0.009s sys 0m0.026s With Relabel test real 0m1.942s user 0m0.007s sys 0m0.030s Signed-off-by: Dan Walsh <dwalsh@redhat.com> Signed-off-by: Dan Walsh <dwalsh@redhat.com>
132 lines
3.7 KiB
Go
132 lines
3.7 KiB
Go
// +build daemon
|
|
|
|
package vfs
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"github.com/docker/docker/daemon/graphdriver"
|
|
"github.com/docker/docker/pkg/chrootarchive"
|
|
"github.com/docker/docker/pkg/idtools"
|
|
|
|
"github.com/opencontainers/runc/libcontainer/label"
|
|
)
|
|
|
|
func init() {
|
|
graphdriver.Register("vfs", Init)
|
|
}
|
|
|
|
// Init returns a new VFS driver.
|
|
// This sets the home directory for the driver and returns NaiveDiffDriver.
|
|
func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (graphdriver.Driver, error) {
|
|
d := &Driver{
|
|
home: home,
|
|
uidMaps: uidMaps,
|
|
gidMaps: gidMaps,
|
|
}
|
|
rootUID, rootGID, err := idtools.GetRootUIDGID(uidMaps, gidMaps)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := idtools.MkdirAllAs(home, 0700, rootUID, rootGID); err != nil {
|
|
return nil, err
|
|
}
|
|
return graphdriver.NewNaiveDiffDriver(d, uidMaps, gidMaps), nil
|
|
}
|
|
|
|
// Driver holds information about the driver, home directory of the driver.
|
|
// Driver implements graphdriver.ProtoDriver. It uses only basic vfs operations.
|
|
// In order to support layering, files are copied from the parent layer into the new layer. There is no copy-on-write support.
|
|
// Driver must be wrapped in NaiveDiffDriver to be used as a graphdriver.Driver
|
|
type Driver struct {
|
|
home string
|
|
uidMaps []idtools.IDMap
|
|
gidMaps []idtools.IDMap
|
|
}
|
|
|
|
func (d *Driver) String() string {
|
|
return "vfs"
|
|
}
|
|
|
|
// Status is used for implementing the graphdriver.ProtoDriver interface. VFS does not currently have any status information.
|
|
func (d *Driver) Status() [][2]string {
|
|
return nil
|
|
}
|
|
|
|
// GetMetadata is used for implementing the graphdriver.ProtoDriver interface. VFS does not currently have any meta data.
|
|
func (d *Driver) GetMetadata(id string) (map[string]string, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
// Cleanup is used to implement graphdriver.ProtoDriver. There is no cleanup required for this driver.
|
|
func (d *Driver) Cleanup() error {
|
|
return nil
|
|
}
|
|
|
|
// Create prepares the filesystem for the VFS driver and copies the directory for the given id under the parent.
|
|
func (d *Driver) Create(id, parent, mountLabel string) error {
|
|
dir := d.dir(id)
|
|
rootUID, rootGID, err := idtools.GetRootUIDGID(d.uidMaps, d.gidMaps)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := idtools.MkdirAllAs(filepath.Dir(dir), 0700, rootUID, rootGID); err != nil {
|
|
return err
|
|
}
|
|
if err := idtools.MkdirAs(dir, 0755, rootUID, rootGID); err != nil {
|
|
return err
|
|
}
|
|
opts := []string{"level:s0"}
|
|
if _, mountLabel, err := label.InitLabels(opts); err == nil {
|
|
label.SetFileLabel(dir, mountLabel)
|
|
}
|
|
if parent == "" {
|
|
return nil
|
|
}
|
|
parentDir, err := d.Get(parent, "")
|
|
if err != nil {
|
|
return fmt.Errorf("%s: %s", parent, err)
|
|
}
|
|
if err := chrootarchive.CopyWithTar(parentDir, dir); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (d *Driver) dir(id string) string {
|
|
return filepath.Join(d.home, "dir", filepath.Base(id))
|
|
}
|
|
|
|
// Remove deletes the content from the directory for a given id.
|
|
func (d *Driver) Remove(id string) error {
|
|
if _, err := os.Stat(d.dir(id)); err != nil {
|
|
return err
|
|
}
|
|
return os.RemoveAll(d.dir(id))
|
|
}
|
|
|
|
// Get returns the directory for the given id.
|
|
func (d *Driver) Get(id, mountLabel string) (string, error) {
|
|
dir := d.dir(id)
|
|
if st, err := os.Stat(dir); err != nil {
|
|
return "", err
|
|
} else if !st.IsDir() {
|
|
return "", fmt.Errorf("%s: not a directory", dir)
|
|
}
|
|
return dir, nil
|
|
}
|
|
|
|
// Put is a noop for vfs that return nil for the error, since this driver has no runtime resources to clean up.
|
|
func (d *Driver) Put(id string) error {
|
|
// The vfs driver has no runtime resources (e.g. mounts)
|
|
// to clean up, so we don't need anything here
|
|
return nil
|
|
}
|
|
|
|
// Exists checks to see if the directory exists for the given id.
|
|
func (d *Driver) Exists(id string) bool {
|
|
_, err := os.Stat(d.dir(id))
|
|
return err == nil
|
|
}
|