mirror of
https://github.com/podman-container-tools/podman.git
synced 2026-10-29 17:27:41 +00:00
d1670573d0
Non-Linux systems, such as BSD kernels, constrain xatter updates according to file permissions. This is in contrast to Linux selinux attr writes, which are governed by an selinux policy. By dafault this policy apllows users to relabel files owned by themselves even if file perms would otherwise disallow write. This results in robust container relabeling results on Linux, and fragile results everywhere else. Therefore, change the mac policy to force the nfs_t context on all files, and ignore all relabel events. As a side-effect, this will disallow any ability to store custom selinux constants on files. However, this is of limited use in a machine context, since files in these volumes are externally managed on systems which do not support SELinux. Signed-off-by: Jason T. Greene <jason.greene@redhat.com> |
||
|---|---|---|
| .. | ||
| annotations | ||
| api | ||
| auth | ||
| autoupdate | ||
| bindings | ||
| channel | ||
| checkpoint | ||
| copy | ||
| criu | ||
| ctime | ||
| domain | ||
| emulation | ||
| env | ||
| errorhandling | ||
| farm | ||
| fileserver | ||
| inspect | ||
| k8s.io | ||
| lookup | ||
| machine | ||
| namespaces | ||
| parallel | ||
| ps | ||
| rctl | ||
| rootless | ||
| seccomp | ||
| selinux | ||
| signal | ||
| specgen | ||
| specgenutil | ||
| specgenutilexternal | ||
| systemd | ||
| terminal | ||
| timetype | ||
| trust | ||
| util | ||