Skip to content

Forward SELinux relabel flags for non-bind mounts - #1538

Open
Sanjays2402 wants to merge 1 commit into
containers:mainfrom
Sanjays2402:fix/selinux-relabel-named-volume-mount
Open

Forward SELinux relabel flags for non-bind mounts#1538
Sanjays2402 wants to merge 1 commit into
containers:mainfrom
Sanjays2402:fix/selinux-relabel-named-volume-mount

Conversation

@Sanjays2402

Copy link
Copy Markdown

Closes #1516

Contributor Checklist:

Please make sure to read development guidelines in CONTRIBUTING.md.

Compose spec for the short volume syntax the relabel flag comes from:
https://github.com/compose-spec/compose-spec/blob/main/spec.md#short-syntax-5

For any user-visible change please add a release note to newsfragments directory.

I could not add the newsfragments/*.bugfix file from my side; please tell me if you want me to
push one, or feel free to add it with this text: "The SELinux relabel flags z and Z given in
the short volume syntax are no longer dropped for named volumes when the mount is passed to podman
as --mount."

All changes require additional unit tests.

Added test_selinux_named_volume_short_syntax in tests/unit/test_container_to_args.py, next to
the existing test_selinux_volume. It fails on main (the ,Z is missing from the generated
--mount argument) and passes with the fix; python -m unittest discover tests/unit is green
(480 tests), and ruff format --check / ruff check are clean on both changed files.


parse_short_mount stores the z/Z of db:/var/lib/mysql:Z as a bind propagation option. Since
--mount became the default for named volumes, mount_desc_to_mount_args() only read the selinux
option for bind mounts, so the relabel flag was silently dropped — which is the 1.5.0 → 1.6.0
regression reported in #1516. This forwards z/Z for the other mount types too, mirroring what
mount_desc_to_volume_args() already does for the -v syntax.

This change was prepared with AI assistance; the regression test was run locally and fails without the fix.

The short volume syntax parser stores z/Z from a mount spec like
db:/var/lib/mysql:Z as a bind propagation option. Since --mount became
the default for named volumes, mount_desc_to_mount_args() only read the
selinux option for bind mounts, so the relabel flag was silently dropped
and the container got an unlabeled volume.

Forward z/Z for the other mount types too, mirroring what
mount_desc_to_volume_args() already does for the -v syntax.

Closes containers#1516

Signed-off-by: Sanjay Santhanam <51058514+Sanjays2402@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

volume mount for selinux z Z broken since 1.6.0

1 participant