-
-
Notifications
You must be signed in to change notification settings - Fork 204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Set SELinux runtime context on unix socket #865
Comments
We already have our client logic automatically connect to /run/incus/unix.socket if present, however we're not likely to move the socket fully to that path for another year or so as we want to make sure that everything that consumes our client code is updated prior to making any such change (some of those are even still using the LXD Go client to talk to Incus). So for now, your only real option is indeed to use INCUS_SOCKET as that's supported even by older clients. We can certainly put logic to try to set the context on the socket to be |
What's the right command to set container_runtime_t as the label on the socket? |
Hi Stéphane, if you mean for testing or so you would use:
Thanks for your quick answer and good work! |
Are you sure? From what I have read in the code this is true for /var/lib/unix.socket I just tested it: The "Error: The incus daemon doesn't appear to be started (socket path: /var/lib/incus/unix.socket)" if only |
Hm. Ok, I will give it another try then. I only could get it to work with a globally set INCUS_SOCKET. Without that Edit: I got it. This is new in 6.1 and I am running 6.0.0, so this is why I could not reproduce it using the socket in /run by iteself |
That'd indeed explain it ;) |
Closes lxc#865 Signed-off-by: Stéphane Graber <[email protected]>
Closes lxc#865 Signed-off-by: Stéphane Graber <[email protected]>
Closes lxc#865 Signed-off-by: Stéphane Graber <[email protected]>
Closes lxc#865 Signed-off-by: Stéphane Graber <[email protected]>
Closes lxc#865 Signed-off-by: Stéphane Graber <[email protected]>
Closes lxc#865 Signed-off-by: Stéphane Graber <[email protected]>
Closes #865 Signed-off-by: Stéphane Graber <[email protected]>
Required information
Issue description
I am currently helping to create a proper SELinux policy module for incus in Gentoo
Currently, the default location for the control socket path is
/var/lib/incus/unix.socket
. This is maybe not the perfect location and putting it in/run/incus
instead would be a better location. Normally not a big deal. But with SELinux this becomes an issue: Files being created inherit their context from the parent directory.In case of incus
/var/lib/incus
has container_var_lib_t and/run/incus
has container_runtime_t. And the socket needs container_runtime_t as well so the incus client can successfully connect to incusd.I know I could set INCUS_SOCKET system-wide to kind of fix that, but as having sockets somewhere in /run/ seems to be the better option anyway I thought it might be worth creating an issue for that.
More options I can think of:
What do you think?
The text was updated successfully, but these errors were encountered: