dotcloud/docker — pull request #4211 by rhatdan (2014-02-18 20:49:08+00:00)
Title: Patch to add SELinux support to docker.

On systems that support SELinux this series of patches will add SELinux labeling support to docker.

The goal of this patch is to confine docker containers based on MAC (Mandatory Access Control). We want to prevent processes running within the container from effecting the host system and from interacting with other containers on the system, via a breakout.

To test you need the libselinux-devel package to be installed.
You also need lxc-1.0.0.beta4-1 or later, which contains SELinux support.

You also need an selinux-policy package installed that provides the
/etc/selinux/targeted/contexts/lxc_contexts file.

Fedora 20/21 and RHEL7 should work fine.

Basically this patch runs the docker processes with a SELinux type specified in the lxc_contexts:
sandbox_lxc_process = "system_u:system_r:svirt_lxc_net_t:s0"

And labels all content in the container with the file label.
file = "system_u:object_r:svirt_sandbox_file_t:s0"

It then generates an unique MCS Label based on the process id of the client.

--priv containers will turn off the labeling.

The first patch is just an update to .gitignore to exclude emacs backup files and *.patch files.

The third patch should not be needed but I could not get go to build the patch when I used label functions in subdirs. It would not find the selinux.go code.

The fourth patch is used to turn on SELinux in the build. This patch should not be on by default as it will break on systems that do not support SELinux.