search

containers / udica

This repository contains a tool for generating SELinux security profiles for containers
GNU General Public License v3.0
478 stars 47 forks source link

Support --tmpfs mount #83

Open mikosa opened 3 years ago

mikosa commented 3 years ago

Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is.

In some cases u need to mount tmpfs for security reasons and for other reasons. so for example u may need to run the following:

podman run -e MYSQL_ROOT_PASSWORD=my-secret-pw --tmpfs /run -d mysql

Describe the solution you'd like udica is not allowing this in the created configuration

Describe alternatives you've considered Not sure if there is a policy i can add. I dont know SElinux. If u have an alternative solution, I would appreciate it too :)

wrabcak commented 3 years ago

Hi @mikosa , Can you please share the SELinux denials? Do you see any troubles with SELinux when you started container as you defined in the issue description?

Thanks, Lukas.

vmojzis commented 2 years ago

Hi @mikosa, could you please specify what issues are you running into (the container won't start at all, you can't access the tmpfs mount, ...)? Also please share any AVC messages you are seeing related to this use case as well as the podman inspect file. Thank you. Vit