Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add mount label man page content #53

Merged
merged 1 commit into from
May 2, 2016
Merged

Add mount label man page content #53

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions man/ocitools-generate.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,18 @@ inside of the container.
**--mount-cgroups**=[rw|ro|no]
Mount cgroups. The default is `no`.

**--mount-label**=[=*MOUNTLABEL*]]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant equal signs? I'd guess this should be --mount-label=[MOUNTLABEL].

Mount Label
Depending on your SELinux policy, you would specify a label that looks like
this:
"system_u:object_r:svirt_sandbox_file_t:s0:c1,c2"

Note you would want your ROOTFS directory to be labeled with a context that
this process type can use.

"system_u:object_r:usr_t:s0" might be a good label for a readonly container,
"system_u:system_r:svirt_sandbox_file_t:s0:c1,c2" for a read/write container.

**--network**
Use network namespace

Expand Down Expand Up @@ -149,7 +161,7 @@ inside of the container.
this process type can use.

"system_u:object_r:usr_t:s0" might be a good label for a readonly container,
"system_u:system_r:svirt_sandbox_file_t:s0:c1,c2" for a read/write container.
"system_u:object_r:svirt_sandbox_file_t:s0:c1,c2" for a read/write container.

**--sysctl**=SYSCTLSETTING
Add sysctl settings e.g net.ipv4.forward=1, only allowed if the syctl is
Expand Down Expand Up @@ -222,7 +234,7 @@ colon:

You can use SELinux to add security to the container. You must specify the process label to run the init process inside of the container using the --selinux-label.

# ocitools generate --bind /var/db:/data1 --selinux-label system_u:system_r:svirt_lxc_net_t:s0:c1,c2 --rootfs /var/lib/containers/fedora --args bash
# ocitools generate --bind /var/db:/data1 --selinux-label system_u:system_r:svirt_lxc_net_t:s0:c1,c2 --mount-label system_u:object_r:svirt_sandbox_file_t:s0:c1,c2 --rootfs /var/lib/containers/fedora --args bash
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Busted rebase partially rolling back #46?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What did I break?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Markdown literals need four-space indents (or fencing).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok I was looking for something in the text I changed. I fixed the markdown.


Not in the above example we used a type of svirt_lxc_net_t and an MCS Label of s0:c1,c2. If you want to guarantee separation between containers, you need to make sure that each container gets launched with a different MCS Label pair.

Expand Down