141 lines
3.7 KiB
Go
141 lines
3.7 KiB
Go
// Copyright (c) Huawei Technologies Co., Ltd. 2018-2019. All rights reserved.
|
|
// isulad-tools is licensed under the Mulan PSL v1.
|
|
// You can use this software according to the terms and conditions of the Mulan PSL v1.
|
|
// You may obtain a copy of Mulan PSL v1 at:
|
|
// http://license.coscl.org.cn/MulanPSL
|
|
// THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
|
|
// IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
|
|
// PURPOSE.
|
|
// See the Mulan PSL v1 for more details.
|
|
// Description: selinux relabel commands
|
|
// Author: zhangwei
|
|
// Create: 2018-01-18
|
|
|
|
// go base main package
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"io/ioutil"
|
|
"os/exec"
|
|
|
|
"isula.org/isulad-tools/utils"
|
|
|
|
"github.com/opencontainers/runc/libcontainer/selinux"
|
|
"github.com/sirupsen/logrus"
|
|
"github.com/urfave/cli"
|
|
)
|
|
|
|
var (
|
|
// Seconfig is absolute path for SELinux config file
|
|
Seconfig = "/etc/selinux/config"
|
|
hostSystemd = "/lib/systemd/systemd"
|
|
)
|
|
|
|
type selinuxCommand struct {
|
|
cmd string
|
|
argv []string
|
|
}
|
|
|
|
type selinuxContext struct {
|
|
conType string
|
|
path string
|
|
}
|
|
|
|
func relabelIsuladBinary(path, bin string) error {
|
|
cmd := exec.Command("semanage", []string{"fcontext", "-a", "-t", "init_exec_t", fmt.Sprintf("%s/%s", path, bin)}...)
|
|
if err := cmd.Start(); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func restartIsulad() error {
|
|
restart := selinuxCommand{"systemctl", []string{"restart", "isulad"}}
|
|
cmd := exec.Command(restart.cmd, restart.argv...)
|
|
logrus.Infof("%s %v", restart.cmd, restart.argv)
|
|
if err := cmd.Run(); err != nil {
|
|
logrus.Errorf("%s %v: %v", restart.cmd, restart.argv, err)
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func relabel(path string) error {
|
|
var seType string
|
|
var attr string
|
|
var err error
|
|
|
|
if seType, err = utils.SeconfigGet(Seconfig, "SELINUXTYPE"); err != nil {
|
|
return err
|
|
}
|
|
utils.SeconfigSet(Seconfig, "SELINUX", "permissive")
|
|
fileContexts := fmt.Sprintf("/etc/selinux/%s/contexts/files/file_contexts.local", seType)
|
|
if !utils.IsExist(fileContexts) {
|
|
if err = ioutil.WriteFile(fileContexts, []byte(""), 0600); err != nil {
|
|
logrus.Errorf("ioutil.WriteFile err: %s", err)
|
|
}
|
|
}
|
|
|
|
preStarts := []selinuxCommand{
|
|
{"setenforce", []string{"0"}},
|
|
}
|
|
|
|
for _, prestart := range preStarts {
|
|
cmd := exec.Command(prestart.cmd, prestart.argv...)
|
|
logrus.Infof("%s %v", prestart.cmd, prestart.argv)
|
|
if err := cmd.Run(); err != nil {
|
|
logrus.Errorf("%s %v: %v", prestart.cmd, prestart.argv, err)
|
|
return err
|
|
}
|
|
}
|
|
|
|
if attr, err = selinux.Getfilecon(hostSystemd); err != nil {
|
|
return nil
|
|
}
|
|
modifyContexts := []selinuxContext{
|
|
{"init_exec_t", path + "/isulad"},
|
|
}
|
|
con := utils.NewContext(attr)
|
|
for _, context := range modifyContexts {
|
|
con.SetType(context.conType)
|
|
logrus.Infof("%s [%s]", context.path, con.Get())
|
|
selinux.Setfilecon(context.path, con.Get())
|
|
}
|
|
|
|
return restartIsulad()
|
|
}
|
|
|
|
func setUpSelinuxLabel(path, rootfs string) error {
|
|
if err := relabel(path); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
var relabelCommand = cli.Command{
|
|
Name: "relabel",
|
|
Usage: "relabel rootfs for running SELinux in system container",
|
|
ArgsUsage: `[--isulad-path path] [--rootfs rootfs]`,
|
|
Description: `relabel rootfs for running SELinux in system container(a systemd based os is required)`,
|
|
Flags: []cli.Flag{
|
|
cli.StringFlag{
|
|
Name: "isulad-path",
|
|
Value: "/usr/bin",
|
|
Usage: "isulad's install path",
|
|
},
|
|
cli.StringFlag{
|
|
Name: "rootfs",
|
|
Usage: "the absolute path for isulad's rootfs",
|
|
},
|
|
},
|
|
Action: func(context *cli.Context) {
|
|
if err := setUpSelinuxLabel(context.String("isulad-path"), context.String("rootfs")); err != nil {
|
|
fatal(err)
|
|
}
|
|
// print result to stdout
|
|
fmt.Printf("SELinux relabel success\n")
|
|
logrus.Infof("SELinux relabel successfully")
|
|
},
|
|
}
|