Skip to content

Commit a3db3df

Browse files
tych0tych0
authored
Merge pull request #2653 from stgraber/selinux
2 parents 9e44cef + 7c199f1 commit a3db3df

File tree

4 files changed

+65
-18
lines changed

4 files changed

+65
-18
lines changed

‎go.mod‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/lxc/incus/v6
22

3-
go 1.24.10
3+
go 1.24.7
44

55
require (
66
github.com/LINBIT/golinstor v0.58.0
@@ -28,7 +28,7 @@ require (
2828
github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b
2929
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
3030
github.com/lxc/go-lxc v0.0.0-20240606200241-27b3d116511f
31-
github.com/lxc/incus-os/incus-osd v0.0.0-20251119202041-c236b7154b01
31+
github.com/lxc/incus-os/incus-osd v0.0.0-20251128203143-ed788dd4e9a0
3232
github.com/mattn/go-colorable v0.1.14
3333
github.com/mattn/go-sqlite3 v1.14.32
3434
github.com/mdlayher/arp v0.0.0-20220512170110-6706a2966875
@@ -56,7 +56,7 @@ require (
5656
github.com/zitadel/oidc/v3 v3.45.0
5757
go.starlark.net v0.0.0-20251109183026-be02852a5e1f
5858
golang.org/x/crypto v0.45.0
59-
golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6
59+
golang.org/x/exp v0.0.0-20251125195548-87e1e737ad39
6060
golang.org/x/oauth2 v0.33.0
6161
golang.org/x/sync v0.18.0
6262
golang.org/x/sys v0.38.0
@@ -66,6 +66,7 @@ require (
6666
google.golang.org/protobuf v1.36.10
6767
gopkg.in/yaml.v2 v2.4.0
6868
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
69+
software.sslmate.com/src/go-pkcs12 v0.6.0
6970
)
7071

7172
require (
@@ -129,7 +130,7 @@ require (
129130
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
130131
github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
131132
github.com/olekukonko/errors v1.1.0 // indirect
132-
github.com/olekukonko/ll v0.1.2 // indirect
133+
github.com/olekukonko/ll v0.1.3 // indirect
133134
github.com/opencontainers/go-digest v1.0.0 // indirect
134135
github.com/opencontainers/image-spec v1.1.1 // indirect
135136
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
@@ -139,7 +140,7 @@ require (
139140
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
140141
github.com/prometheus/client_golang v1.23.2 // indirect
141142
github.com/prometheus/client_model v0.6.2 // indirect
142-
github.com/prometheus/common v0.67.3 // indirect
143+
github.com/prometheus/common v0.67.4 // indirect
143144
github.com/prometheus/procfs v0.19.2 // indirect
144145
github.com/rivo/uniseg v0.4.7 // indirect
145146
github.com/rootless-containers/proto/go-proto v0.0.0-20230421021042-4cd87ebadd67 // indirect
@@ -171,9 +172,8 @@ require (
171172
golang.org/x/mod v0.30.0 // indirect
172173
golang.org/x/net v0.47.0 // indirect
173174
golang.org/x/time v0.14.0 // indirect
174-
google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba // indirect
175+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846 // indirect
175176
google.golang.org/grpc v1.77.0 // indirect
176177
gopkg.in/yaml.v3 v3.0.1 // indirect
177178
moul.io/http2curl/v2 v2.3.0 // indirect
178-
software.sslmate.com/src/go-pkcs12 v0.6.0 // indirect
179179
)

‎go.sum‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -357,8 +357,8 @@ github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIi
357357
github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
358358
github.com/lxc/go-lxc v0.0.0-20240606200241-27b3d116511f h1:KnZqnn4R9Ae+jOK7DwacF1CnWEBMSwoXh44owa6j6k4=
359359
github.com/lxc/go-lxc v0.0.0-20240606200241-27b3d116511f/go.mod h1:3UTWXVcHfgxE7JM4ZUnsy6bDA8L1vuzwJbJRF6dlB90=
360-
github.com/lxc/incus-os/incus-osd v0.0.0-20251119202041-c236b7154b01 h1:V9xuIAv/BRVH0J4R0HgiK6xQWimI66DCxLvRIHPd7Fk=
361-
github.com/lxc/incus-os/incus-osd v0.0.0-20251119202041-c236b7154b01/go.mod h1:P8nh0S3MSLbHLHAWBwY9yZuoS8qk3EHyNZx7+u9aq68=
360+
github.com/lxc/incus-os/incus-osd v0.0.0-20251128203143-ed788dd4e9a0 h1:idGZGRLjqLpFZBlNv4VkiFPfvgYwnkFilfyc3K7SEBE=
361+
github.com/lxc/incus-os/incus-osd v0.0.0-20251128203143-ed788dd4e9a0/go.mod h1:a8i0bZTQBLt0BBu/KxpWsBFEJIgfjMUPXjDYMqdrxCg=
362362
github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
363363
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
364364
github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
@@ -432,8 +432,8 @@ github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj
432432
github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
433433
github.com/olekukonko/errors v1.1.0 h1:RNuGIh15QdDenh+hNvKrJkmxxjV4hcS50Db478Ou5sM=
434434
github.com/olekukonko/errors v1.1.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
435-
github.com/olekukonko/ll v0.1.2 h1:lkg/k/9mlsy0SxO5aC+WEpbdT5K83ddnNhAepz7TQc0=
436-
github.com/olekukonko/ll v0.1.2/go.mod h1:b52bVQRRPObe+yyBl0TxNfhesL0nedD4Cht0/zx55Ew=
435+
github.com/olekukonko/ll v0.1.3 h1:sV2jrhQGq5B3W0nENUISCR6azIPf7UBUpVq0x/y70Fg=
436+
github.com/olekukonko/ll v0.1.3/go.mod h1:b52bVQRRPObe+yyBl0TxNfhesL0nedD4Cht0/zx55Ew=
437437
github.com/olekukonko/tablewriter v1.1.0 h1:N0LHrshF4T39KvI96fn6GT8HEjXRXYNDrDjKFDB7RIY=
438438
github.com/olekukonko/tablewriter v1.1.0/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
439439
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -482,8 +482,8 @@ github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UH
482482
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
483483
github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
484484
github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
485-
github.com/prometheus/common v0.67.3 h1:shd26MlnwTw5jksTDhC7rTQIteBxy+ZZDr3t7F2xN2Q=
486-
github.com/prometheus/common v0.67.3/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI=
485+
github.com/prometheus/common v0.67.4 h1:yR3NqWO1/UyO1w2PhUvXlGQs/PtFmoveVO0KZ4+Lvsc=
486+
github.com/prometheus/common v0.67.4/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI=
487487
github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
488488
github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
489489
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
@@ -648,8 +648,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
648648
golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
649649
golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
650650
golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
651-
golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6 h1:zfMcR1Cs4KNuomFFgGefv5N0czO2XZpUbxGUy8i8ug0=
652-
golang.org/x/exp v0.0.0-20251113190631-e25ba8c21ef6/go.mod h1:46edojNIoXTNOhySWIWdix628clX9ODXwPsQuG6hsK0=
651+
golang.org/x/exp v0.0.0-20251125195548-87e1e737ad39 h1:DHNhtq3sNNzrvduZZIiFyXWOL9IWaDPHqTnLJp+rCBY=
652+
golang.org/x/exp v0.0.0-20251125195548-87e1e737ad39/go.mod h1:46edojNIoXTNOhySWIWdix628clX9ODXwPsQuG6hsK0=
653653
golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
654654
golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
655655
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -947,8 +947,8 @@ google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6D
947947
google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
948948
google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
949949
google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
950-
google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba h1:UKgtfRM7Yh93Sya0Fo8ZzhDP4qBckrrxEr2oF5UIVb8=
951-
google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
950+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846 h1:Wgl1rcDNThT+Zn47YyCXOXyX/COgMTIdhJ717F0l4xk=
951+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
952952
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
953953
google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
954954
google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=

‎internal/server/instance/drivers/driver_common.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"errors"
77
"fmt"
88
"math"
9+
"math/rand/v2"
910
"net/http"
1011
"os"
1112
"path/filepath"
@@ -1726,3 +1727,44 @@ func (d *common) setOOMPriority(pid int) error {
17261727

17271728
return nil
17281729
}
1730+
1731+
// selinuxContext returns the SELinux context for the instance.
1732+
func (d *common) selinuxContext(baseContext string) (string, error) {
1733+
// Get all local instances.
1734+
instances, err := instance.LoadNodeAll(d.state, instancetype.Any)
1735+
if err != nil {
1736+
return "", fmt.Errorf("Failed loading local instances: %w", err)
1737+
}
1738+
1739+
// Get all current values.
1740+
seContexts := make([]string, 0, len(instances))
1741+
for _, inst := range instances {
1742+
if !inst.IsRunning() {
1743+
continue
1744+
}
1745+
1746+
val, err := os.ReadFile(filepath.Join("/proc", strconv.Itoa(inst.InitPID()), "attr", "current"))
1747+
if err != nil {
1748+
return "", err
1749+
}
1750+
1751+
seContexts = append(seContexts, strings.TrimSuffix(string(val), "\x00"))
1752+
}
1753+
1754+
// Generate a random set of categories.
1755+
for {
1756+
c1 := rand.IntN(1023)
1757+
c2 := rand.IntN(1023)
1758+
1759+
if c1 == c2 {
1760+
continue
1761+
}
1762+
1763+
seContext := baseContext + ":c" + strconv.Itoa(c1) + ",c" + strconv.Itoa(c2)
1764+
if slices.Contains(seContexts, seContext) {
1765+
continue
1766+
}
1767+
1768+
return seContext, nil
1769+
}
1770+
}

‎internal/server/instance/drivers/driver_lxc.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1022,7 +1022,12 @@ func (d *lxc) initLXC(config bool) (*liblxc.Container, error) {
10221022

10231023
// Setup SELinux.
10241024
if d.state.OS.SELinuxAvailable && d.state.OS.SELinuxContextInstanceLXC != "" {
1025-
err := lxcSetConfigItem(cc, "lxc.selinux.context", fmt.Sprintf("%s:c%d", d.state.OS.SELinuxContextInstanceLXC, d.id))
1025+
seContext, err := d.selinuxContext(d.state.OS.SELinuxContextInstanceLXC)
1026+
if err != nil {
1027+
return nil, err
1028+
}
1029+
1030+
err = lxcSetConfigItem(cc, "lxc.selinux.context", seContext)
10261031
if err != nil {
10271032
return nil, err
10281033
}

0 commit comments

Comments
 (0)