Skip to content

SELinux: Fixup man page #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mrunalp merged 1 commit into from
May 12, 2016
Merged

SELinux: Fixup man page #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions man/ocitools-generate.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ ocitools-generate - Generate a config.json for an OCI container
compatable runtime like runC to run a container.

# OPTIONS
**--apparmor**="PROFILE"
**--apparmor**=PROFILE
Specifies the the apparmor profile for the container

**--arch**="ARCH"
**--arch**=ARCH
Architecture used within the container.
"amd64"

Expand All @@ -27,7 +27,7 @@ compatable runtime like runC to run a container.

--args "/usr/bin/httpd" --args "-D" --args "FOREGROUND"

**--bind**=[=*[[HOST-DIR:CONTAINER-DIR][:OPTIONS]]*] Bind mount
**--bind**=*[[HOST-DIR:CONTAINER-DIR][:OPTIONS]]* Bind mount
directories src:dest:(rw,ro) If you specify, ` --bind
/HOST-DIR:/CONTAINER-DIR`, runc bind mounts `/HOST-DIR` in the host
to `/CONTAINER-DIR` in the OCI container. The `OPTIONS` are a comma
Expand Down Expand Up @@ -79,7 +79,7 @@ inside of the container.
**--mount-cgroups**=[rw|ro|no]
Mount cgroups. The default is `no`.

**--mount-label**=[=*MOUNTLABEL*]]
**--mount-label**=MOUNTLABEL
Mount Label
Depending on your SELinux policy, you would specify a label that looks like
this:
Expand Down Expand Up @@ -119,15 +119,15 @@ inside of the container.
Path to command to run in prestart hooks. This command will be run before
the container process gets launched but after the container environment.

**--privileged**=*true*|*false*
**--privileged**=true|false
Give extended privileges to this container. The default is *false*.

By default, OCI containers are
“unprivileged” (=false) and cannot do some of the things a normal root process can do.

When the operator executes **ocitools generate --privileged**, OCI will enable access to all devices on the host as well as disable some of the confinement mechanisms like AppArmor, SELinux, and seccomp from blocking access to privileged processes. This gives the container processes nearly all the same access to the host as processes generating outside of a container on the host.

**--read-only**=*true*|*false*
**--read-only**=true|false
Mount the container's root filesystem as read only.

By default a container will have its root filesystem writable allowing processes to write files anywhere. By specifying the `--read-only` flag the container will have its root filesystem mounted as read only prohibiting any writes.
Expand All @@ -136,7 +136,7 @@ inside of the container.
Mount propagation for root filesystem.
Values are "SHARED, RSHARED, PRIVATE, RPRIVATE, SLAVE, RSLAVE"

**--rootfs**="*ROOTFSPATH*"
**--rootfs**=ROOTFSPATH
Path to the rootfs

**--seccomp-arch**=ARCH
Expand All @@ -151,7 +151,7 @@ inside of the container.
Specifies Additional syscalls permitted to be used for system calls,
e.g Name:Action:Arg1_index/Arg1_value/Arg1_valuetwo/Arg1_op, Arg2_index/Arg2_value/Arg2_valuetwo/Arg2_op

**--selinux-label**=[=*SELINUXLABEL*]]
**--selinux-label**=PROCESSLABEL
SELinux Label
Depending on your SELinux policy, you would specify a label that looks like
this:
Expand Down Expand Up @@ -234,7 +234,7 @@ colon:

You can use SELinux to add security to the container. You must specify the process label to run the init process inside of the container using the --selinux-label.

# ocitools generate --bind /var/db:/data1 --selinux-label system_u:system_r:svirt_lxc_net_t:s0:c1,c2 --mount-label system_u:object_r:svirt_sandbox_file_t:s0:c1,c2 --rootfs /var/lib/containers/fedora --args bash
# ocitools generate --bind /var/db:/data1 --selinux-label system_u:system_r:svirt_lxc_net_t:s0:c1,c2 --mount-label system_u:object_r:svirt_sandbox_file_t:s0:c1,c2 --rootfs /var/lib/containers/fedora --args bash

Not in the above example we used a type of svirt_lxc_net_t and an MCS Label of s0:c1,c2. If you want to guarantee separation between containers, you need to make sure that each container gets launched with a different MCS Label pair.

Expand Down
6 changes: 2 additions & 4 deletions man/ocitools-validate.1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,7 @@
ocitools-validate - Validate a OCI bundle

# SYNOPSIS
**ocitools validate**
[**--help**]
[**--path**[=*PATH*]
**ocitools validate** *[OPTIONS]*

# DESCRIPTION

Expand All @@ -17,7 +15,7 @@ Validate an OCI bundle
**--help**
Print usage statement

**--path="PATH"
**--path=PATH
Path to bundle

# SEE ALSO
Expand Down