{"action":"created","comment":{"url":"https://api.github.com/repos/coreos/rkt/pulls/comments/59464244","id":59464244,"diff_hunk":"@@ -1,10 +1,22 @@\n # rkt and SELinux\n \n rkt supports running containers using SELinux [SVirt](http://selinuxproject.org/page/SVirt).\n-At start-up, rkt will attempt to read `/etc/selinux/(policy)/contexts/lxc_contexts`.\n-If this file doesn't exist, no SELinux transitions will be performed.\n-If it does, rkt will generate a per-instance context.\n-All mounts for the instance will be created using the file context defined in `lxc_contexts`, and the instance processes will be run in a context derived from the process context defined in `lxc_contexts`.\n+The SELinux context for each rkt pod can be set in one of two ways:\n \n-Processes started in these contexts will be unable to interact with processes or files in any other instance's context, even though they are running as the same user.\n+### Reading SElinux context from the host lxc_contexts file\n+\n+When invoking `rkt run` or `rkt run-prepared`, rkt will attempt to read `/etc/selinux/(policy)/contexts/lxc_contexts`.\n+If this file does not exist, SELinux transitions will be performed.\n+Otherwise, rkt will generate a per-pod context.\n+All mounts for the pod will be created using the file context defined in `lxc_contexts`, and the processes inside the pod will be run in a context derived from the process context defined in `lxc_contexts`.\n+\n+Processes started in these contexts will be unable to interact with processes or files in any other pod's context, even though they are running as the same user.","path":"Documentation/selinux.md","position":18,"original_position":18,"commit_id":"a043962c3fe3572c6344440016d4757b4665551d","original_commit_id":"a043962c3fe3572c6344440016d4757b4665551d","user":{"login":"euank","id":2147649,"avatar_url":"https://avatars.githubusercontent.com/u/2147649?v=3","gravatar_id":"","url":"https://api.github.com/users/euank","html_url":"https://github.com/euank","followers_url":"https://api.github.com/users/euank/followers","following_url":"https://api.github.com/users/euank/following{/other_user}","gists_url":"https://api.github.com/users/euank/gists{/gist_id}","starred_url":"https://api.github.com/users/euank/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/euank/subscriptions","organizations_url":"https://api.github.com/users/euank/orgs","repos_url":"https://api.github.com/users/euank/repos","events_url":"https://api.github.com/users/euank/events{/privacy}","received_events_url":"https://api.github.com/users/euank/received_events","type":"User","site_admin":false},"body":"This and the next paragraph both apply with either method of setting an selinux context, but it being placed here indicates it only applies to the first.\r\n\r\nMaybe there should to be a new section below for these bits of info?","created_at":"2016-04-12T22:20:06Z","updated_at":"2016-04-12T22:20:06Z","html_url":"https://github.com/coreos/rkt/pull/2361#discussion_r59464244","pull_request_url":"https://api.github.com/repos/coreos/rkt/pulls/2361","_links":{"self":{"href":"https://api.github.com/repos/coreos/rkt/pulls/comments/59464244"},"html":{"href":"https://github.com/coreos/rkt/pull/2361#discussion_r59464244"},"pull_request":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2361"}}},"pull_request":{"url":"https://api.github.com/repos/coreos/rkt/pulls/2361","id":64916479,"html_url":"https://github.com/coreos/rkt/pull/2361","diff_url":"https://github.com/coreos/rkt/pull/2361.diff","patch_url":"https://github.com/coreos/rkt/pull/2361.patch","issue_url":"https://api.github.com/repos/coreos/rkt/issues/2361","number":2361,"state":"open","locked":false,"title":"Add `--selinux-options` to `rkt run` and `rkt run-prepared`","user":{"login":"yifan-gu","id":3278588,"avatar_url":"https://avatars.githubusercontent.com/u/3278588?v=3","gravatar_id":"","url":"https://api.github.com/users/yifan-gu","html_url":"https://github.com/yifan-gu","followers_url":"https://api.github.com/users/yifan-gu/followers","following_url":"https://api.github.com/users/yifan-gu/following{/other_user}","gists_url":"https://api.github.com/users/yifan-gu/gists{/gist_id}","starred_url":"https://api.github.com/users/yifan-gu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yifan-gu/subscriptions","organizations_url":"https://api.github.com/users/yifan-gu/orgs","repos_url":"https://api.github.com/users/yifan-gu/repos","events_url":"https://api.github.com/users/yifan-gu/events{/privacy}","received_events_url":"https://api.github.com/users/yifan-gu/received_events","type":"User","site_admin":false},"body":"In this PR:\r\n- `--selinux-options` is passed to `rkt run` and `rkt run-prepared` to enable we pass the selinux context via command line. This enables rktnetes to implement the [SElinuxOptions](https://github.com/kubernetes/kubernetes/blob/v1.3.0-alpha.1/pkg/api/types.go#L2517) in [Pod.SecurityConext.Selinx](https://github.com/kubernetes/kubernetes/blob/v1.3.0-alpha.1/pkg/api/types.go#L1249)\r\n- `rkt run-prepared` is also able to run with selinux context support now.\r\n- Fix a bug where `mcsdir` is not defined when first generating a random `level` options.\r\n\r\nRef #https://github.com/kubernetes/kubernetes/pull/14192\r\n\r\ncc @jonboulle @mjg59 @alban @iaguis @vcaputo @pmorie ","created_at":"2016-04-01T09:18:11Z","updated_at":"2016-04-12T22:20:06Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0edba0da55c9d6e43829f17f997b0086600cab91","assignee":null,"milestone":{"url":"https://api.github.com/repos/coreos/rkt/milestones/34","html_url":"https://github.com/coreos/rkt/milestones/v1.4.0","labels_url":"https://api.github.com/repos/coreos/rkt/milestones/34/labels","id":1651915,"number":34,"title":"v1.4.0","description":"","creator":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"open_issues":65,"closed_issues":25,"state":"open","created_at":"2016-03-17T18:01:01Z","updated_at":"2016-04-12T20:26:23Z","due_on":"2016-04-13T22:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/coreos/rkt/pulls/2361/commits","review_comments_url":"https://api.github.com/repos/coreos/rkt/pulls/2361/comments","review_comment_url":"https://api.github.com/repos/coreos/rkt/pulls/comments{/number}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/2361/comments","statuses_url":"https://api.github.com/repos/coreos/rkt/statuses/a043962c3fe3572c6344440016d4757b4665551d","head":{"label":"yifan-gu:selinux_option","ref":"selinux_option","sha":"a043962c3fe3572c6344440016d4757b4665551d","user":{"login":"yifan-gu","id":3278588,"avatar_url":"https://avatars.githubusercontent.com/u/3278588?v=3","gravatar_id":"","url":"https://api.github.com/users/yifan-gu","html_url":"https://github.com/yifan-gu","followers_url":"https://api.github.com/users/yifan-gu/followers","following_url":"https://api.github.com/users/yifan-gu/following{/other_user}","gists_url":"https://api.github.com/users/yifan-gu/gists{/gist_id}","starred_url":"https://api.github.com/users/yifan-gu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yifan-gu/subscriptions","organizations_url":"https://api.github.com/users/yifan-gu/orgs","repos_url":"https://api.github.com/users/yifan-gu/repos","events_url":"https://api.github.com/users/yifan-gu/events{/privacy}","received_events_url":"https://api.github.com/users/yifan-gu/received_events","type":"User","site_admin":false},"repo":{"id":31437138,"name":"rocket","full_name":"yifan-gu/rocket","owner":{"login":"yifan-gu","id":3278588,"avatar_url":"https://avatars.githubusercontent.com/u/3278588?v=3","gravatar_id":"","url":"https://api.github.com/users/yifan-gu","html_url":"https://github.com/yifan-gu","followers_url":"https://api.github.com/users/yifan-gu/followers","following_url":"https://api.github.com/users/yifan-gu/following{/other_user}","gists_url":"https://api.github.com/users/yifan-gu/gists{/gist_id}","starred_url":"https://api.github.com/users/yifan-gu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yifan-gu/subscriptions","organizations_url":"https://api.github.com/users/yifan-gu/orgs","repos_url":"https://api.github.com/users/yifan-gu/repos","events_url":"https://api.github.com/users/yifan-gu/events{/privacy}","received_events_url":"https://api.github.com/users/yifan-gu/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/yifan-gu/rocket","description":"App Container runtime","fork":true,"url":"https://api.github.com/repos/yifan-gu/rocket","forks_url":"https://api.github.com/repos/yifan-gu/rocket/forks","keys_url":"https://api.github.com/repos/yifan-gu/rocket/keys{/key_id}","collaborators_url":"https://api.github.com/repos/yifan-gu/rocket/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/yifan-gu/rocket/teams","hooks_url":"https://api.github.com/repos/yifan-gu/rocket/hooks","issue_events_url":"https://api.github.com/repos/yifan-gu/rocket/issues/events{/number}","events_url":"https://api.github.com/repos/yifan-gu/rocket/events","assignees_url":"https://api.github.com/repos/yifan-gu/rocket/assignees{/user}","branches_url":"https://api.github.com/repos/yifan-gu/rocket/branches{/branch}","tags_url":"https://api.github.com/repos/yifan-gu/rocket/tags","blobs_url":"https://api.github.com/repos/yifan-gu/rocket/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/yifan-gu/rocket/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/yifan-gu/rocket/git/refs{/sha}","trees_url":"https://api.github.com/repos/yifan-gu/rocket/git/trees{/sha}","statuses_url":"https://api.github.com/repos/yifan-gu/rocket/statuses/{sha}","languages_url":"https://api.github.com/repos/yifan-gu/rocket/languages","stargazers_url":"https://api.github.com/repos/yifan-gu/rocket/stargazers","contributors_url":"https://api.github.com/repos/yifan-gu/rocket/contributors","subscribers_url":"https://api.github.com/repos/yifan-gu/rocket/subscribers","subscription_url":"https://api.github.com/repos/yifan-gu/rocket/subscription","commits_url":"https://api.github.com/repos/yifan-gu/rocket/commits{/sha}","git_commits_url":"https://api.github.com/repos/yifan-gu/rocket/git/commits{/sha}","comments_url":"https://api.github.com/repos/yifan-gu/rocket/comments{/number}","issue_comment_url":"https://api.github.com/repos/yifan-gu/rocket/issues/comments{/number}","contents_url":"https://api.github.com/repos/yifan-gu/rocket/contents/{+path}","compare_url":"https://api.github.com/repos/yifan-gu/rocket/compare/{base}...{head}","merges_url":"https://api.github.com/repos/yifan-gu/rocket/merges","archive_url":"https://api.github.com/repos/yifan-gu/rocket/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/yifan-gu/rocket/downloads","issues_url":"https://api.github.com/repos/yifan-gu/rocket/issues{/number}","pulls_url":"https://api.github.com/repos/yifan-gu/rocket/pulls{/number}","milestones_url":"https://api.github.com/repos/yifan-gu/rocket/milestones{/number}","notifications_url":"https://api.github.com/repos/yifan-gu/rocket/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/yifan-gu/rocket/labels{/name}","releases_url":"https://api.github.com/repos/yifan-gu/rocket/releases{/id}","deployments_url":"https://api.github.com/repos/yifan-gu/rocket/deployments","created_at":"2015-02-27T20:12:42Z","updated_at":"2015-04-01T01:18:09Z","pushed_at":"2016-04-12T01:33:39Z","git_url":"git://github.com/yifan-gu/rocket.git","ssh_url":"git@github.com:yifan-gu/rocket.git","clone_url":"https://github.com/yifan-gu/rocket.git","svn_url":"https://github.com/yifan-gu/rocket","homepage":"","size":19776,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"coreos:master","ref":"master","sha":"98552bd69225c45efb40287d7d9fbf249327f3f8","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":26509369,"name":"rkt","full_name":"coreos/rkt","owner":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/coreos/rkt","description":"rkt is an App Container runtime for Linux","fork":false,"url":"https://api.github.com/repos/coreos/rkt","forks_url":"https://api.github.com/repos/coreos/rkt/forks","keys_url":"https://api.github.com/repos/coreos/rkt/keys{/key_id}","collaborators_url":"https://api.github.com/repos/coreos/rkt/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/coreos/rkt/teams","hooks_url":"https://api.github.com/repos/coreos/rkt/hooks","issue_events_url":"https://api.github.com/repos/coreos/rkt/issues/events{/number}","events_url":"https://api.github.com/repos/coreos/rkt/events","assignees_url":"https://api.github.com/repos/coreos/rkt/assignees{/user}","branches_url":"https://api.github.com/repos/coreos/rkt/branches{/branch}","tags_url":"https://api.github.com/repos/coreos/rkt/tags","blobs_url":"https://api.github.com/repos/coreos/rkt/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/coreos/rkt/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/coreos/rkt/git/refs{/sha}","trees_url":"https://api.github.com/repos/coreos/rkt/git/trees{/sha}","statuses_url":"https://api.github.com/repos/coreos/rkt/statuses/{sha}","languages_url":"https://api.github.com/repos/coreos/rkt/languages","stargazers_url":"https://api.github.com/repos/coreos/rkt/stargazers","contributors_url":"https://api.github.com/repos/coreos/rkt/contributors","subscribers_url":"https://api.github.com/repos/coreos/rkt/subscribers","subscription_url":"https://api.github.com/repos/coreos/rkt/subscription","commits_url":"https://api.github.com/repos/coreos/rkt/commits{/sha}","git_commits_url":"https://api.github.com/repos/coreos/rkt/git/commits{/sha}","comments_url":"https://api.github.com/repos/coreos/rkt/comments{/number}","issue_comment_url":"https://api.github.com/repos/coreos/rkt/issues/comments{/number}","contents_url":"https://api.github.com/repos/coreos/rkt/contents/{+path}","compare_url":"https://api.github.com/repos/coreos/rkt/compare/{base}...{head}","merges_url":"https://api.github.com/repos/coreos/rkt/merges","archive_url":"https://api.github.com/repos/coreos/rkt/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/coreos/rkt/downloads","issues_url":"https://api.github.com/repos/coreos/rkt/issues{/number}","pulls_url":"https://api.github.com/repos/coreos/rkt/pulls{/number}","milestones_url":"https://api.github.com/repos/coreos/rkt/milestones{/number}","notifications_url":"https://api.github.com/repos/coreos/rkt/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/coreos/rkt/labels{/name}","releases_url":"https://api.github.com/repos/coreos/rkt/releases{/id}","deployments_url":"https://api.github.com/repos/coreos/rkt/deployments","created_at":"2014-11-11T23:13:18Z","updated_at":"2016-04-12T18:42:29Z","pushed_at":"2016-04-12T20:26:23Z","git_url":"git://github.com/coreos/rkt.git","ssh_url":"git@github.com:coreos/rkt.git","clone_url":"https://github.com/coreos/rkt.git","svn_url":"https://github.com/coreos/rkt","homepage":"","size":23654,"stargazers_count":5391,"watchers_count":5391,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":492,"mirror_url":null,"open_issues_count":277,"forks":492,"open_issues":277,"watchers":5391,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2361"},"html":{"href":"https://github.com/coreos/rkt/pull/2361"},"issue":{"href":"https://api.github.com/repos/coreos/rkt/issues/2361"},"comments":{"href":"https://api.github.com/repos/coreos/rkt/issues/2361/comments"},"review_comments":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2361/comments"},"review_comment":{"href":"https://api.github.com/repos/coreos/rkt/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2361/commits"},"statuses":{"href":"https://api.github.com/repos/coreos/rkt/statuses/a043962c3fe3572c6344440016d4757b4665551d"}}}}