From 4f23c44a68514e0d8fb23315de101ac37f034ec1 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Wed, 28 Oct 2015 15:41:46 -0400 Subject: [PATCH] Fix relabel for SELinux With the changes merged into runc/libcontainer, are now causing SELinux to attempt a relabel always, even if the user did not request the relabel. If the user does not specify Z or z on the volume mount we should not attempt a relabel. Signed-off-by: Dan Walsh (cherry picked from commit d9011b36176d6245bdc25401633c213d73e14ea0) --- daemon/volumes_unix.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/daemon/volumes_unix.go b/daemon/volumes_unix.go index 3b32c65f9..94e91317f 100644 --- a/daemon/volumes_unix.go +++ b/daemon/volumes_unix.go @@ -365,9 +365,10 @@ func (daemon *Daemon) registerMountPoints(container *Container, hostConfig *runc } } - shared := label.IsShared(bind.Mode) - if err := label.Relabel(bind.Source, container.MountLabel, shared); err != nil { - return err + if label.RelabelNeeded(bind.Mode) { + if err := label.Relabel(bind.Source, container.MountLabel, label.IsShared(bind.Mode)); err != nil { + return err + } } binds[bind.Destination] = true mountPoints[bind.Destination] = bind