Documentation
¶
Index ¶
- Variables
- func FormatMountLabel(src, mountLabel string) string
- func FormatMountLabelByType(src, mountLabel, contextType string) string
- func GenLabels(options string) (string, string, error)deprecated
- func Init()
- func InitLabels(options []string) (plabel string, mlabel string, retErr error)
- func IsShared(label string) bool
- func Relabel(path string, fileLabel string, shared bool) error
- func RelabelNeeded(label string) bool
- func ReleaseLabel(label string) error
- func ReserveLabel(label string) error
- func SetFileCreateLabel(fileLabel string) error
- func SetFileLabel(path string, fileLabel string) error
- func Validate(label string) error
Constants ¶
This section is empty.
Variables ¶
var ClearLabels = selinux.ClearLabels
ClearLabels will clear all reserved labels Deprecated: use selinux.ClearLabels
var DisableSecOpt = selinux.DisableSecOpt
DisableSecOpt returns a security opt that can disable labeling support for future container processes Deprecated: use selinux.DisableSecOpt
var DupSecOpt = selinux.DupSecOpt
DupSecOpt takes a process label and returns security options that can be used to set duplicate labels on future container processes Deprecated: use selinux.DupSecOpt
var ErrIncompatibleLabel = errors.New("Bad SELinux option z and Z can not be used together")
var FileLabel = selinux.FileLabel
FileLabel returns the label for specified path Deprecated: use selinux.FileLabel
var KeyLabel = selinux.KeyLabel
KeyLabel retrieves the current default kernel keyring label setting Deprecated: use selinux.KeyLabel
var PidLabel = selinux.PidLabel
PidLabel will return the label of the process running with the specified pid Deprecated: use selinux.PidLabel
var ProcessLabel = selinux.ExecLabel
ProcessLabel returns the process label that the kernel will assign to the next program executed by the current process. If "" is returned this indicates that the default labeling will happen for the process. Deprecated: use selinux.ExecLabel
var ROMountLabel = selinux.ROFileLabel
Deprecated: use selinux.ROFileLabel
var SetKeyLabel = selinux.SetKeyLabel
SetKeyLabel takes a process label and tells the kernel to assign the label to the next kernel keyring that gets created Deprecated: use selinux.SetKeyLabel
var SetProcessLabel = selinux.SetExecLabel
SetProcessLabel takes a process label and tells the kernel to assign the label to the next program executed by the current process. Deprecated: use selinux.SetExecLabel
var SetSocketLabel = selinux.SetSocketLabel
SetSocketLabel takes a process label and tells the kernel to assign the label to the next socket that gets created Deprecated: use selinux.SetSocketLabel
var SocketLabel = selinux.SocketLabel
SocketLabel retrieves the current default socket label setting Deprecated: use selinux.SocketLabel
Functions ¶
func FormatMountLabel ¶
FormatMountLabel returns a string to be used by the mount command. Using the SELinux `context` mount option. Changing labels of files on mount points with this option can never be changed. FormatMountLabel returns a string to be used by the mount command. The format of this string will be used to alter the labeling of the mountpoint. The string returned is suitable to be used as the options field of the mount command. If you need to have additional mount point options, you can pass them in as the first parameter. Second parameter is the label that you wish to apply to all content in the mount point.
func FormatMountLabelByType ¶ added in v1.11.0
FormatMountLabelByType returns a string to be used by the mount command. Allow caller to specify the mount options. For example using the SELinux `fscontext` mount option would allow certain container processes to change labels of files created on the mount points, where as `context` option does not. FormatMountLabelByType returns a string to be used by the mount command. The format of this string will be used to alter the labeling of the mountpoint. The string returned is suitable to be used as the options field of the mount command. If you need to have additional mount point options, you can pass them in as the first parameter. Second parameter is the label that you wish to apply to all content in the mount point.
func InitLabels ¶
InitLabels returns the process label and file labels to be used within the container. A list of options can be passed into this function to alter the labels. The labels returned will include a random MCS String, that is guaranteed to be unique. If the disabled flag is passed in, the process label will not be set, but the mount label will be set to the container_file label with the maximum category. This label is not usable by any confined label.
func Relabel ¶
Relabel changes the label of path and all the entries beneath the path. It changes the MCS label to s0 if shared is true. This will allow all containers to share the content.
The path itself is guaranteed to be relabeled last.
func RelabelNeeded ¶
RelabelNeeded checks whether the user requested a relabel
func ReleaseLabel ¶
ReleaseLabel will remove the reservation of the MCS label. This will allow InitLabels to use the MCS label in a newly created containers Deprecated: use selinux.ReleaseLabel
func ReserveLabel ¶
ReserveLabel will record the fact that the MCS label has already been used. This will prevent InitLabels from using the MCS label in a newly created container Deprecated: use selinux.ReserveLabel
func SetFileCreateLabel ¶
SetFileCreateLabel tells the kernel the label for all files to be created
func SetFileLabel ¶
SetFileLabel modifies the "path" label to the specified file label
Types ¶
This section is empty.
Source Files