Daniel J Walsh ad8a96ab95 Support running nested SELinux container separation ... Currently Podman prevents SELinux container separation, when running within a container. This PR adds a new --security-opt label=nested When setting this option, Podman unmasks and mountsi /sys/fs/selinux into the containers making /sys/fs/selinux fully exposed. Secondly Podman sets the attribute run.oci.mount_context_type=rootcontext This attribute tells crun to mount volumes with rootcontext=MOUNTLABEL as opposed to context=MOUNTLABEL. With these two settings Podman inside the container is allowed to set its own SELinux labels on tmpfs file systems mounted into its parents container, while still being confined by SELinux. Thus you can have nested SELinux labeling inside of a container. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>		2023-03-13 14:21:12 -04:00
..
attach.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
checkpoint.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
cleanup.go	New system tests for conflicting options	2022-12-21 06:23:29 -05:00
clone.go	implement podman update	2022-09-01 13:02:01 -04:00
commit.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
container.go	bump go module to version 4	2022-01-18 12:47:07 +01:00
cp.go	podman cp: fix copying with "." suffix	2022-11-14 09:38:02 +01:00
create.go	Support running nested SELinux container separation	2023-03-13 14:21:12 -04:00
diff.go	cmd/podman: switch to golang native error wrapping	2022-06-30 12:58:57 +02:00
exec.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
exists.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
export.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
init.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
inspect.go	shell completion: update podman inspect --type options	2022-05-19 14:04:22 +02:00
kill.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
list.go	bump go module to version 4	2022-01-18 12:47:07 +01:00
logs.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
mount.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
pause.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
port.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
prune.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
ps.go	fix: don't output "ago" when container is currently up and running	2023-01-27 12:32:15 +01:00
rename.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
restart.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
restore.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
rm.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
run.go	bump golangci-lint to v1.50.1	2022-12-15 13:39:56 +01:00
runlabel.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
start.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
stats.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
stop.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
top.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
unmount.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
unpause.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00
update.go	Fix default handling of pids-limit	2023-01-27 23:19:44 -06:00
wait.go	Allow '/' to prefix container names to match Docker	2022-12-26 07:37:43 -05:00