From 8437669639fdfccf429d27dcff1aa8431e7e9500 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Mon, 11 May 2015 18:28:36 -0400 Subject: [PATCH] Modify volume mounts SELinux labels on the fly based on :Z or :z This patch is extending the qualifiers on the -v command to allow an admin to tell the system to relabel, content. There might be a need for something similar for changing the DAC Permissions. Signed-off-by: Jessica Frazelle Upstream-commit: 011e17933c5b4f3ab2e2b65086a2530c5a921fc1 Component: cli --- .../cli/docs/sources/reference/commandline/cli.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/components/cli/docs/sources/reference/commandline/cli.md b/components/cli/docs/sources/reference/commandline/cli.md index 3d92b3ed67..c5e276e3a3 100644 --- a/components/cli/docs/sources/reference/commandline/cli.md +++ b/components/cli/docs/sources/reference/commandline/cli.md @@ -2181,6 +2181,19 @@ mount the volumes in read-only or read-write mode, respectively. By default, the volumes are mounted in the same mode (read write or read only) as the reference container. +Labeling systems like SELinux require proper labels be placed on volume content +mounted into a container, otherwise the security system might prevent the +processes running inside the container from using the content. By default, +volumes are not relabeled. + +Two suffixes :z or :Z can be added to the volume mount. These suffixes tell +Docker to relabel file objects on the shared volumes. The 'z' option tells +Docker that the volume content will be shared between containers. Docker will +label the content with a shared content label. Shared volumes labels allow all +containers to read/write content. The 'Z' option tells Docker to label the +content with a private unshared label. Private volumes can only be used by the +current container. + The `-a` flag tells `docker run` to bind to the container's `STDIN`, `STDOUT` or `STDERR`. This makes it possible to manipulate the output and input as needed. @@ -2222,7 +2235,7 @@ flag: $ docker run --device=/dev/sda:/dev/xvdc --rm -it ubuntu fdisk /dev/xvdc Command (m for help): q - $ docker run --device=/dev/sda:/dev/xvdc:r --rm -it ubuntu fdisk /dev/xvdc + $ docker run --device=/dev/sda:/dev/xvdc:ro --rm -it ubuntu fdisk /dev/xvdc You will not be able to write the partition table. Command (m for help): q