Skip to content

Commit

Permalink
feat: use github.com/gardenlinux/seccomp_fake_xattr on enable selinux…
Browse files Browse the repository at this point in the history
… on selinux builds
  • Loading branch information
nkraetzschmar committed Apr 15, 2024
1 parent f1864b0 commit bf3ee70
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 1 deletion.
4 changes: 4 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -28,5 +28,9 @@ RUN mv /aws_kms_pkcs11.so "/usr/lib/$(uname -m)-linux-gnu/pkcs11/aws_kms_pkcs11.
COPY builder /builder
RUN mkdir /builder/cert
COPY setup_namespace /usr/sbin/setup_namespace
RUN curl -sSLf https://github.com/gardenlinux/seccomp_fake_xattr/releases/download/latest/seccomp_fake_xattr-$(uname -m).tar.gz \
| gzip -d \
| tar -xO seccomp_fake_xattr-$(uname -m)/fake_xattr > /usr/bin/fake_xattr \
&& chmod +x /usr/bin/fake_xattr
RUN echo 'root:1:65535' | tee /etc/subuid /etc/subgid > /dev/null
ENTRYPOINT [ "/usr/sbin/setup_namespace" ]
2 changes: 1 addition & 1 deletion setup_namespace
Original file line number Diff line number Diff line change
Expand Up @@ -7,5 +7,5 @@ if [ "${1-}" = --second-stage ]; then
mount -t tmpfs -o size=4G tmpfs /tmp
"$@"
else
unshare --map-root-user --map-users auto --map-groups auto --mount "$0" --second-stage "$@"
unshare --map-root-user --map-users auto --map-groups auto --mount fake_xattr "$0" --second-stage "$@"
fi

0 comments on commit bf3ee70

Please sign in to comment.