pytest-docker-pexpect icon indicating copy to clipboard operation
pytest-docker-pexpect copied to clipboard

Support mounting volumes with SELinux enabled

Open septatrix opened this issue 4 years ago • 0 comments

Under fedora where SELinux is enabled the mounted volume cannot be accessed as it is forbidden by policies. Instead the volume has to be mounted with the :z (or :Z) option to be able to read it. This relabels the directory from unconfined_u:object_r:user_home_t:s0 to system_u:object_r:container_file_t:s0 (or with an additional unique it for :Z). Doing so allows access to the mounted volume. Systems where SELinux is not enabled should not be affected by this.

I did this manually by mounting the volume once with the :z flag after which the changed label persists and subsequent containers are able to access it. I even tested this with docker symlinked to podman so that is nicely compatible.

septatrix avatar Jan 03 '22 14:01 septatrix