{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/runc/issues/731","repository_url":"https://api.github.com/repos/opencontainers/runc","labels_url":"https://api.github.com/repos/opencontainers/runc/issues/731/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/runc/issues/731/comments","events_url":"https://api.github.com/repos/opencontainers/runc/issues/731/events","html_url":"https://github.com/opencontainers/runc/pull/731","id":146806673,"number":731,"title":"don't relabel mqueue with user ns  and make selinux and user ns can be used at the same time","user":{"login":"keloyang","id":11223367,"avatar_url":"https://avatars.githubusercontent.com/u/11223367?v=3","gravatar_id":"","url":"https://api.github.com/users/keloyang","html_url":"https://github.com/keloyang","followers_url":"https://api.github.com/users/keloyang/followers","following_url":"https://api.github.com/users/keloyang/following{/other_user}","gists_url":"https://api.github.com/users/keloyang/gists{/gist_id}","starred_url":"https://api.github.com/users/keloyang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keloyang/subscriptions","organizations_url":"https://api.github.com/users/keloyang/orgs","repos_url":"https://api.github.com/users/keloyang/repos","events_url":"https://api.github.com/users/keloyang/events{/privacy}","received_events_url":"https://api.github.com/users/keloyang/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/opencontainers/runc/labels/status/0-triage","name":"status/0-triage","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-04-08T03:56:11Z","updated_at":"2016-04-12T01:34:36Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/opencontainers/runc/pulls/731","html_url":"https://github.com/opencontainers/runc/pull/731","diff_url":"https://github.com/opencontainers/runc/pull/731.diff","patch_url":"https://github.com/opencontainers/runc/pull/731.patch"},"body":"after mount mqueue with user namespace,we will have a view like the following:\r\n```\r\nroot@6996292ba929:/# ls /dev/ -Zn|grep mqueue\r\ndrwxrwxrwt. 2 65534 65534 unconfined_u:object_r:user_tmpfs_t:s0\r\n```\r\nwe can see the uid is  65534,this make sys_lsetxattr fail when kernel has a kuid_has_mapping check,so that we can't start a container with selinux and user ns at the same time.\r\nproc and sys also have 65534 uid after mount ,and they are not relabeled.So we can remove the relabel for mqueue,If so, selinux and user ns can be used at the same time.\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\nSigned-off-by: yangshukui <yangshukui@huawei.com>"},"comment":{"url":"https://api.github.com/repos/opencontainers/runc/issues/comments/208657349","html_url":"https://github.com/opencontainers/runc/pull/731#issuecomment-208657349","issue_url":"https://api.github.com/repos/opencontainers/runc/issues/731","id":208657349,"user":{"login":"keloyang","id":11223367,"avatar_url":"https://avatars.githubusercontent.com/u/11223367?v=3","gravatar_id":"","url":"https://api.github.com/users/keloyang","html_url":"https://github.com/keloyang","followers_url":"https://api.github.com/users/keloyang/followers","following_url":"https://api.github.com/users/keloyang/following{/other_user}","gists_url":"https://api.github.com/users/keloyang/gists{/gist_id}","starred_url":"https://api.github.com/users/keloyang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keloyang/subscriptions","organizations_url":"https://api.github.com/users/keloyang/orgs","repos_url":"https://api.github.com/users/keloyang/repos","events_url":"https://api.github.com/users/keloyang/events{/privacy}","received_events_url":"https://api.github.com/users/keloyang/received_events","type":"User","site_admin":false},"created_at":"2016-04-12T01:34:36Z","updated_at":"2016-04-12T01:34:36Z","body":"mqueue get a user_tmpfs_t label by default, why mqueue has a bad label ,can we modify the default  label for mqueue?\r\nsys_lsetxattr  eventually use kuid_has_mapping:\r\nsys_lsetxattr-->path_setxattr-->setxattr-->vfs_setxattr-->security_inode_setxattr-->call_int_hook-->selinux_inode_setxattr-->inode_owner_or_capable-->kuid_has_mapping"}}