hkparker / i2p-docker

Java I2P router in Docker
MIT License
15 stars 12 forks source link

Do not advise users to disable SELinux #19

Closed alexhaydock closed 6 years ago

alexhaydock commented 6 years ago

Thank you for your work on this useful container.

In your README for this repo, you suggest that users disable SELinux using the setenforce 0 command, and manually change SELinux contexts using chcon.

This is unnecessary and (in the case of disabling SELinux) opens users up to risk.

Docker bind mounts have an inbuilt mechanism for automatically setting SELinux contexts on bind mounted directories.

In the case of this container, :Z could be added to the bind mount to make the recommendations from the README file unnecessary:

-v ~/.i2p:/var/lib/i2p:Z

As noted by the Docker documentation, using :Z will automatically set SELinux labels for the mount directory that allow it to be used just with the container in question.

(The lowercase :z can also be used for situations where the directory will be mounted and shared between multiple containers, but I don't see that as being necessary here.)

Thanks again for this project. :+1:

hkparker commented 6 years ago

Nice! Thanks for pointing this out. I'm not familiar with selinux and have been deferring to those more experienced for a solution here. I'll add this to the README, unless you'd like to make a PR explaining this.

hkparker commented 6 years ago

@nevergone this work in your environment?

hkparker commented 6 years ago

Updated in 6ed46f18