[Bug 1109537] New: gear command line cannot be run with a confined user
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1109537
Bug ID: 1109537
Summary: gear command line cannot be run with a confined user
Product: Fedora
Version: 20
Component: geard
Assignee: lsm5(a)redhat.com
Reporter: misc(a)zarb.org
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
lsm5(a)redhat.com
Description of problem:
$ gear
zsh: permission denied: gear
$ id -Z
staff_u:staff_r:staff_t:s0-s0:c0.c1023
WIth setenforce 0, it work fine.
# rpm -q selinux-policy
selinux-policy-3.12.1-166.fc20.noarch
I am not sure if gear can be run as a simple user, but i would at least expect
to be able to see the command line options, since there is no manpage.
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 7 months
[docker-io/el6] Resolves: rhbz#1145660, rhbz#1139415
by Lokesh Mandvekar
commit 80e29f1917f8d2cd0ac9312283b8e6d96847843d
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Sep 25 14:35:55 2014 -0500
Resolves: rhbz#1145660, rhbz#1139415
NVR: docker-io-1.2.0-3
rhbz#1145660: support for /etc/sysconfig/docker-storage
rhbz#1139415: correct bash completion install path
Also ignores selinux if disabled.
https://github.com/docker/docker/commit/9e2eb0f1cc3c4ef000e139f1d85a20f0e...
modified: docker-io.spec
new file: docker-storage.sysconfig
modified: docker.service
new file: ignore-selinux-if-disabled.patch
Signed-off-by: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
docker-io.spec | 44 ++++++++----
docker-storage.sysconfig | 14 ++++
docker.sysconfig | 2 +-
docker.sysvinit | 131 ++++++++++++++++++++++++++++++++++++++
ignore-selinux-if-disabled.patch | 54 ++++++++++++++++
5 files changed, 229 insertions(+), 16 deletions(-)
---
diff --git a/docker-io.spec b/docker-io.spec
index 6cbf24d..9ce937e 100644
--- a/docker-io.spec
+++ b/docker-io.spec
@@ -11,7 +11,7 @@
Name: docker-io
Version: 1.2.0
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: Automates deployment of containerized applications
License: ASL 2.0
URL: http://www.docker.com
@@ -21,12 +21,14 @@ Source0: https://github.com/docker/docker/archive/v%{version}.tar.gz
# though final name for sysconf file is simply 'docker',
# having .sysconfig makes things clear
Source1: docker.sysconfig
-BuildRequires: gcc
+Source2: docker-storage.sysconfig
+# have init script wait up to 5 mins before forcibly terminating docker daemon
+# https://github.com/docker/docker/commit/640d2ef6f54d96ac4fc3f0f745cb1e6a3...
+Source3: docker.sysvinit
+Patch0: ignore-selinux-if-disabled.patch
BuildRequires: glibc-static
BuildRequires: pandoc
-# ensure build uses golang 1.2-7 and above
-# http://code.google.com/p/go/source/detail?r=a15f344a9efa35ef168c8feaa92a1...
-BuildRequires: golang >= 1.2-7
+BuildRequires: golang >= 1.3
# for gorilla/mux and kr/pty https://github.com/dotcloud/docker/pull/5950
BuildRequires: golang(github.com/gorilla/mux) >= 0-0.13
BuildRequires: golang(github.com/kr/pty) >= 0-0.19
@@ -68,8 +70,8 @@ and tests on a laptop will run at scale, in production*, on VMs, bare-metal
servers, OpenStack clusters, public instances, or combinations of the above.
%package devel
-BuildRequires: golang
-Requires: golang
+BuildRequires: golang >= 1.2.1-3
+Requires: golang >= 1.2.1-3
Requires: docker-io-pkg-devel
Summary: A golang registry for global request variables (source libraries)
Provides: golang(%{import_path}) = %{version}-%{release}
@@ -116,8 +118,8 @@ Provides: golang(%{import_path}/utils/broadcastwriter) = %{version}-%{rele
This is the source libraries for docker.
%package pkg-devel
-BuildRequires: golang
-Requires: golang
+BuildRequires: golang >= 1.2.1-3
+Requires: golang >= 1.2.1-3
Summary: A golang registry for global request variables (source libraries)
Provides: golang(%{import_path}/pkg/graphdb) = %{version}-%{release}
Provides: golang(%{import_path}/pkg/iptables) = %{version}-%{release}
@@ -153,6 +155,8 @@ find . -name "*.go" \
-print |\
xargs sed -i 's/github.com\/docker\/docker\/vendor\/src\/code.google.com\/p\/go\/src\/pkg\///g'
sed -i 's/go-md2man -in "$FILE" -out/pandoc -s -t man "$FILE" -o/g' docs/man/md2man-all.sh
+%patch0 -p1
+rm daemon/daemon.go.orig
%build
# set up temporary build gopath, and put our directory there
@@ -185,8 +189,8 @@ install -d %{buildroot}%{_mandir}/man5
install -p -m 644 docs/man/man5/Dockerfile.5 %{buildroot}%{_mandir}/man5
# install bash completion
-install -d %{buildroot}%{_sysconfdir}/bash_completion.d
-install -p -m 644 contrib/completion/bash/docker %{buildroot}%{_sysconfdir}/bash_completion.d/docker.bash
+install -dp %{buildroot}%{_datadir}/bash_completion/completions
+install -p -m 644 contrib/completion/bash/docker %{buildroot}%{_datadir}/bash_completion/completions
# install zsh completion
# zsh completion has been upstreamed into docker and
@@ -211,8 +215,9 @@ install -d -m 700 %{buildroot}%{_sharedstatedir}/docker
# install init scripts
install -d %{buildroot}%{_sysconfdir}/sysconfig/
install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/sysconfig/docker
+install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/docker-storage
install -d %{buildroot}%{_initddir}
-install -p -m 755 contrib/init/sysvinit-redhat/docker %{buildroot}%{_initddir}/docker
+install -p -m 755 %{SOURCE3} %{buildroot}%{_initddir}/docker
# sources
install -d -p %{buildroot}/%{gopath}/src/%{import_path}
@@ -261,15 +266,15 @@ fi
%defattr(-,root,root,-)
%doc AUTHORS CHANGELOG.md CONTRIBUTING.md LICENSE MAINTAINERS NOTICE README.md
%doc LICENSE-vim-syntax README-vim-syntax.md
+%config(noreplace) %{_sysconfdir}/sysconfig/docker
+%config(noreplace) %{_sysconfdir}/sysconfig/docker-storage
%{_mandir}/man1/docker*.1.gz
%{_mandir}/man5/Dockerfile.5.gz
%{_bindir}/docker
%dir %{_libexecdir}/docker
%{_libexecdir}/docker/dockerinit
-%config(noreplace) %{_sysconfdir}/sysconfig/docker
%{_initddir}/docker
-%dir %{_sysconfdir}/bash_completion.d
-%{_sysconfdir}/bash_completion.d/docker.bash
+%{_datadir}/bash_completion/completions/docker
%{_datadir}/zsh/site-functions/_docker
%dir %{_sharedstatedir}/docker
%dir %{_sysconfdir}/udev/rules.d
@@ -472,6 +477,15 @@ fi
%{gopath}/src/%{import_path}/pkg/version/*.go
%changelog
+* Thu Sep 25 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.2.0-2
+- Resolves: rhbz#1145660 - support /etc/sysconfig/docker-storage
+ From: Colin Walters <walters(a)redhat.com>
+- patch to ignore selinux if it's disabled
+ https://github.com/docker/docker/commit/9e2eb0f1cc3c4ef000e139f1d85a20f0e...
+ From: Dan Walsh <dwalsh(a)redhat.com>
+- Resolves: rhbz#1139415 - correct path for bash completion
+- init script waits upto 5 mins before terminating daemon
+
* Sat Aug 23 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.2.0-1
- Resolves: rhbz#1132824 - update to v1.2.0
diff --git a/docker-storage.sysconfig b/docker-storage.sysconfig
new file mode 100644
index 0000000..3dc1654
--- /dev/null
+++ b/docker-storage.sysconfig
@@ -0,0 +1,14 @@
+# This file may be automatically generated by an installation program.
+
+# By default, Docker uses a loopback-mounted sparse file in
+# /var/lib/docker. The loopback makes it slower, and there are some
+# restrictive defaults, such as 100GB max storage.
+
+# If your installation did not set a custom storage for Docker, you
+# may do it below.
+
+# Example: Use a custom pair of raw logical volumes (one for metadata,
+# one for data).
+# DOCKER_STORAGE_OPTIONS = --storage-opt dm.metadatadev=/dev/mylogvol/my-docker-metadata --storage-opt dm.datadev=/dev/mylogvol/my-docker-data
+
+DOCKER_STORAGE_OPTIONS=
diff --git a/docker.sysconfig b/docker.sysconfig
index 5f9b7e5..7078b4a 100644
--- a/docker.sysconfig
+++ b/docker.sysconfig
@@ -4,4 +4,4 @@
# These will be parsed by the sysv initscript and appended
# to the arguments list passed to docker -d
-other_args=""
+other_args=
diff --git a/docker.sysvinit b/docker.sysvinit
new file mode 100644
index 0000000..f6c917a
--- /dev/null
+++ b/docker.sysvinit
@@ -0,0 +1,131 @@
+#!/bin/sh
+#
+# /etc/rc.d/init.d/docker
+#
+# Daemon for docker.com
+#
+# chkconfig: 2345 95 95
+# description: Daemon for docker.com
+
+### BEGIN INIT INFO
+# Provides: docker
+# Required-Start: $network cgconfig
+# Required-Stop:
+# Should-Start:
+# Should-Stop:
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: start and stop docker
+# Description: Daemon for docker.com
+### END INIT INFO
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+prog="docker"
+exec="/usr/bin/$prog"
+pidfile="/var/run/$prog.pid"
+lockfile="/var/lock/subsys/$prog"
+logfile="/var/log/$prog"
+
+[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
+[ -e /etc/sysconfig/$prog-storage ] && . /etc/sysconfig/$prog-storage
+
+prestart() {
+ service cgconfig status > /dev/null
+
+ if [[ $? != 0 ]]; then
+ service cgconfig start
+ fi
+
+}
+
+start() {
+ [ -x $exec ] || exit 5
+
+ if ! [ -f $pidfile ]; then
+ prestart
+ printf "Starting $prog:\t"
+ echo "\n$(date)\n" >> $logfile
+ $exec -d $other_args $DOCKER_STORAGE_OPTIONS &>> $logfile &
+ pid=$!
+ touch $lockfile
+ # wait up to 10 seconds for the pidfile to exist. see
+ # https://github.com/docker/docker/issues/5359
+ tries=0
+ while [ ! -f $pidfile -a $tries -lt 10 ]; do
+ sleep 1
+ tries=$((tries + 1))
+ done
+ success
+ echo
+ else
+ failure
+ echo
+ printf "$pidfile still exists...\n"
+ exit 7
+ fi
+}
+
+stop() {
+ echo -n $"Stopping $prog: "
+ killproc -p $pidfile -d 300 $prog
+ retval=$?
+ echo
+ [ $retval -eq 0 ] && rm -f $lockfile
+ return $retval
+}
+
+restart() {
+ stop
+ start
+}
+
+reload() {
+ restart
+}
+
+force_reload() {
+ restart
+}
+
+rh_status() {
+ status -p $pidfile $prog
+}
+
+rh_status_q() {
+ rh_status >/dev/null 2>&1
+}
+
+case "$1" in
+ start)
+ rh_status_q && exit 0
+ $1
+ ;;
+ stop)
+ rh_status_q || exit 0
+ $1
+ ;;
+ restart)
+ $1
+ ;;
+ reload)
+ rh_status_q || exit 7
+ $1
+ ;;
+ force-reload)
+ force_reload
+ ;;
+ status)
+ rh_status
+ ;;
+ condrestart|try-restart)
+ rh_status_q || exit 0
+ restart
+ ;;
+ *)
+ echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
+ exit 2
+esac
+
+exit $?
diff --git a/ignore-selinux-if-disabled.patch b/ignore-selinux-if-disabled.patch
new file mode 100644
index 0000000..42630fe
--- /dev/null
+++ b/ignore-selinux-if-disabled.patch
@@ -0,0 +1,54 @@
+From 9e2eb0f1cc3c4ef000e139f1d85a20f0e00971e6 Mon Sep 17 00:00:00 2001
+From: Dan Walsh <dwalsh(a)redhat.com>
+Date: Tue, 23 Sep 2014 07:46:02 -0400
+Subject: [PATCH] --selinux-enabled flag should be ignored on Disabled SELinux
+ systems
+
+On Fedora and RHEL we ship selinux-enabled flag in the docker.service config,
+but if people setup the /var/lib/docker as btrfs and disable SELinux,
+we should not block the daemon from running.
+
+Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh(a)redhat.com> (github: rhatdan)
+---
+ daemon/daemon.go | 2 +-
+ daemon/utils_linux.go | 4 ++++
+ daemon/utils_nolinux.go | 4 ++++
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/daemon/daemon.go b/daemon/daemon.go
+index 9515a1a..bf78f10 100644
+--- a/daemon/daemon.go
++++ b/daemon/daemon.go
+@@ -775,7 +775,7 @@ func NewDaemonFromDirectory(config *Config, eng *engine.Engine) (*Daemon, error)
+ log.Debugf("Using graph driver %s", driver)
+
+ // As Docker on btrfs and SELinux are incompatible at present, error on both being enabled
+- if config.EnableSelinuxSupport && driver.String() == "btrfs" {
++ if selinuxEnabled() && config.EnableSelinuxSupport && driver.String() == "btrfs" {
+ return nil, fmt.Errorf("SELinux is not supported with the BTRFS graph driver!")
+ }
+
+diff --git a/daemon/utils_linux.go b/daemon/utils_linux.go
+index bff2a78..fb35152 100644
+--- a/daemon/utils_linux.go
++++ b/daemon/utils_linux.go
+@@ -11,3 +11,7 @@ func selinuxSetDisabled() {
+ func selinuxFreeLxcContexts(label string) {
+ selinux.FreeLxcContexts(label)
+ }
++
++func selinuxEnabled() bool {
++ return selinux.SelinuxEnabled()
++}
+diff --git a/daemon/utils_nolinux.go b/daemon/utils_nolinux.go
+index 399376d..25a56ad 100644
+--- a/daemon/utils_nolinux.go
++++ b/daemon/utils_nolinux.go
+@@ -7,3 +7,7 @@ func selinuxSetDisabled() {
+
+ func selinuxFreeLxcContexts(label string) {
+ }
++
++func selinuxEnabled() bool {
++ return false
++}
9 years, 7 months
[docker-io/f20] Resolves: rhbz#1145660, rhbz#1139415
by Lokesh Mandvekar
commit 2521d2ee40ff74fb392ade27770d70fab621b90e
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Sep 25 14:35:55 2014 -0500
Resolves: rhbz#1145660, rhbz#1139415
NVR: docker-io-1.2.0-3
rhbz#1145660: support for /etc/sysconfig/docker-storage
rhbz#1139415: correct bash completion install path
Also ignores selinux if disabled.
https://github.com/docker/docker/commit/9e2eb0f1cc3c4ef000e139f1d85a20f0e...
Signed-off-by: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
modified: docker-io.spec
new file: docker-storage.sysconfig
modified: docker.service
new file: ignore-selinux-if-disabled.patch
docker-io.spec | 25 +++++++++++++----
docker-storage.sysconfig | 14 ++++++++++
docker.service | 3 +-
ignore-selinux-if-disabled.patch | 54 ++++++++++++++++++++++++++++++++++++++
4 files changed, 89 insertions(+), 7 deletions(-)
---
diff --git a/docker-io.spec b/docker-io.spec
index e62fe40..1a4576a 100644
--- a/docker-io.spec
+++ b/docker-io.spec
@@ -11,7 +11,7 @@
Name: docker-io
Version: 1.2.0
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: Automates deployment of containerized applications
License: ASL 2.0
URL: http://www.docker.com
@@ -20,9 +20,10 @@ ExclusiveArch: x86_64
Source0: https://github.com/docker/docker/archive/v%{version}.tar.gz
Source1: docker.service
Source2: docker.sysconfig
+Source3: docker-storage.sysconfig
+Patch0: ignore-selinux-if-disabled.patch
# though final name for sysconf/sysvinit files is simply 'docker',
# having .sysvinit and .sysconfig makes things clear
-BuildRequires: gcc
BuildRequires: glibc-static
# ensure build uses golang 1.2-7 and above
# http://code.google.com/p/go/source/detail?r=a15f344a9efa35ef168c8feaa92a1...
@@ -161,6 +162,8 @@ find . -name "*.go" \
-print |\
xargs sed -i 's/github.com\/docker\/docker\/vendor\/src\/code.google.com\/p\/go\/src\/pkg\///g'
sed -i 's/go-md2man -in "$FILE" -out/pandoc -s -t man "$FILE" -o/g' docs/man/md2man-all.sh
+%patch0 -p1
+rm daemon/daemon.go.orig
%build
# set up temporary build gopath, and put our directory there
@@ -192,8 +195,8 @@ install -d %{buildroot}%{_mandir}/man5
install -p -m 644 docs/man/man5/Dockerfile.5 %{buildroot}%{_mandir}/man5
# install bash completion
-install -d %{buildroot}%{_sysconfdir}/bash_completion.d
-install -p -m 644 contrib/completion/bash/docker %{buildroot}%{_sysconfdir}/bash_completion.d/docker.bash
+install -dp %{buildroot}%{_datadir}/bash_completion/completions
+install -p -m 644 contrib/completion/bash/docker %{buildroot}%{_datadir}/bash_completion/completions
# install zsh completion
# this has been included in upstream zsh, will be removed once it's included
@@ -223,6 +226,7 @@ install -p -m 644 contrib/init/systemd/docker.socket %{buildroot}%{_unitdir}
# for additional args
install -d %{buildroot}%{_sysconfdir}/sysconfig/
install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/docker
+install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/docker-storage
# sources
install -d -p %{buildroot}/%{gopath}/src/%{import_path}
@@ -250,6 +254,7 @@ exit 0
%doc AUTHORS CHANGELOG.md CONTRIBUTING.md LICENSE MAINTAINERS NOTICE README.md
%doc LICENSE-vim-syntax README-vim-syntax.md
%config(noreplace) %{_sysconfdir}/sysconfig/docker
+%config(noreplace) %{_sysconfdir}/sysconfig/docker-storage
%{_mandir}/man1/docker*.1.gz
%{_mandir}/man5/Dockerfile.5.gz
%{_bindir}/docker
@@ -257,8 +262,8 @@ exit 0
%{_libexecdir}/docker/dockerinit
%{_unitdir}/docker.service
%{_unitdir}/docker.socket
-%dir %{_sysconfdir}/bash_completion.d
-%{_sysconfdir}/bash_completion.d/docker.bash
+%dir %{_datadir}/bash_completion/completions
+%{_datadir}/bash_completion/completions/docker
%{_datadir}/zsh/site-functions/_docker
%dir %{_sharedstatedir}/docker
%dir %{_sysconfdir}/udev/rules.d
@@ -459,6 +464,14 @@ exit 0
%{gopath}/src/%{import_path}/pkg/version/*.go
%changelog
+* Thu Sep 25 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.2.0-3
+- Resolves: rhbz#1145660 - support /etc/sysconfig/docker-storage
+ From: Colin Walters <walters(a)redhat.com>
+- patch to ignore selinux if it's disabled
+ https://github.com/docker/docker/commit/9e2eb0f1cc3c4ef000e139f1d85a20f0e...
+ From: Dan Walsh <dwalsh(a)redhat.com>
+- Resolves: rhbz#1139415 - correct path for bash completion
+
* Sun Aug 24 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.2.0-2
- Provides docker only for f21 and above
diff --git a/docker-storage.sysconfig b/docker-storage.sysconfig
new file mode 100644
index 0000000..3dc1654
--- /dev/null
+++ b/docker-storage.sysconfig
@@ -0,0 +1,14 @@
+# This file may be automatically generated by an installation program.
+
+# By default, Docker uses a loopback-mounted sparse file in
+# /var/lib/docker. The loopback makes it slower, and there are some
+# restrictive defaults, such as 100GB max storage.
+
+# If your installation did not set a custom storage for Docker, you
+# may do it below.
+
+# Example: Use a custom pair of raw logical volumes (one for metadata,
+# one for data).
+# DOCKER_STORAGE_OPTIONS = --storage-opt dm.metadatadev=/dev/mylogvol/my-docker-metadata --storage-opt dm.datadev=/dev/mylogvol/my-docker-data
+
+DOCKER_STORAGE_OPTIONS=
diff --git a/docker.service b/docker.service
index 9b6c614..100e824 100644
--- a/docker.service
+++ b/docker.service
@@ -7,7 +7,8 @@ Requires=docker.socket
[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/docker
-ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS
+EnvironmentFile=-/etc/sysconfig/docker-storage
+ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS $DOCKER_STORAGE_OPTIONS
LimitNOFILE=1048576
LimitNPROC=1048576
diff --git a/ignore-selinux-if-disabled.patch b/ignore-selinux-if-disabled.patch
new file mode 100644
index 0000000..42630fe
--- /dev/null
+++ b/ignore-selinux-if-disabled.patch
@@ -0,0 +1,54 @@
+From 9e2eb0f1cc3c4ef000e139f1d85a20f0e00971e6 Mon Sep 17 00:00:00 2001
+From: Dan Walsh <dwalsh(a)redhat.com>
+Date: Tue, 23 Sep 2014 07:46:02 -0400
+Subject: [PATCH] --selinux-enabled flag should be ignored on Disabled SELinux
+ systems
+
+On Fedora and RHEL we ship selinux-enabled flag in the docker.service config,
+but if people setup the /var/lib/docker as btrfs and disable SELinux,
+we should not block the daemon from running.
+
+Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh(a)redhat.com> (github: rhatdan)
+---
+ daemon/daemon.go | 2 +-
+ daemon/utils_linux.go | 4 ++++
+ daemon/utils_nolinux.go | 4 ++++
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/daemon/daemon.go b/daemon/daemon.go
+index 9515a1a..bf78f10 100644
+--- a/daemon/daemon.go
++++ b/daemon/daemon.go
+@@ -775,7 +775,7 @@ func NewDaemonFromDirectory(config *Config, eng *engine.Engine) (*Daemon, error)
+ log.Debugf("Using graph driver %s", driver)
+
+ // As Docker on btrfs and SELinux are incompatible at present, error on both being enabled
+- if config.EnableSelinuxSupport && driver.String() == "btrfs" {
++ if selinuxEnabled() && config.EnableSelinuxSupport && driver.String() == "btrfs" {
+ return nil, fmt.Errorf("SELinux is not supported with the BTRFS graph driver!")
+ }
+
+diff --git a/daemon/utils_linux.go b/daemon/utils_linux.go
+index bff2a78..fb35152 100644
+--- a/daemon/utils_linux.go
++++ b/daemon/utils_linux.go
+@@ -11,3 +11,7 @@ func selinuxSetDisabled() {
+ func selinuxFreeLxcContexts(label string) {
+ selinux.FreeLxcContexts(label)
+ }
++
++func selinuxEnabled() bool {
++ return selinux.SelinuxEnabled()
++}
+diff --git a/daemon/utils_nolinux.go b/daemon/utils_nolinux.go
+index 399376d..25a56ad 100644
+--- a/daemon/utils_nolinux.go
++++ b/daemon/utils_nolinux.go
+@@ -7,3 +7,7 @@ func selinuxSetDisabled() {
+
+ func selinuxFreeLxcContexts(label string) {
+ }
++
++func selinuxEnabled() bool {
++ return false
++}
9 years, 7 months
[docker-io/f21] Resolves: rhbz#1145660, rhbz#1139415
by Lokesh Mandvekar
commit 4e572a4f93ee6c1bbb8592adb3768e79920950b3
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Sep 25 14:35:55 2014 -0500
Resolves: rhbz#1145660, rhbz#1139415
NVR: docker-io-1.2.0-3
rhbz#1145660: support for /etc/sysconfig/docker-storage
rhbz#1139415: correct bash completion install path
Also ignores selinux if disabled.
https://github.com/docker/docker/commit/9e2eb0f1cc3c4ef000e139f1d85a20f0e...
Signed-off-by: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
modified: docker-io.spec
new file: docker-storage.sysconfig
modified: docker.service
new file: ignore-selinux-if-disabled.patch
docker-io.spec | 25 +++++++++++++----
docker-storage.sysconfig | 14 ++++++++++
docker.service | 3 +-
ignore-selinux-if-disabled.patch | 54 ++++++++++++++++++++++++++++++++++++++
4 files changed, 89 insertions(+), 7 deletions(-)
---
diff --git a/docker-io.spec b/docker-io.spec
index e62fe40..1a4576a 100644
--- a/docker-io.spec
+++ b/docker-io.spec
@@ -11,7 +11,7 @@
Name: docker-io
Version: 1.2.0
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: Automates deployment of containerized applications
License: ASL 2.0
URL: http://www.docker.com
@@ -20,9 +20,10 @@ ExclusiveArch: x86_64
Source0: https://github.com/docker/docker/archive/v%{version}.tar.gz
Source1: docker.service
Source2: docker.sysconfig
+Source3: docker-storage.sysconfig
+Patch0: ignore-selinux-if-disabled.patch
# though final name for sysconf/sysvinit files is simply 'docker',
# having .sysvinit and .sysconfig makes things clear
-BuildRequires: gcc
BuildRequires: glibc-static
# ensure build uses golang 1.2-7 and above
# http://code.google.com/p/go/source/detail?r=a15f344a9efa35ef168c8feaa92a1...
@@ -161,6 +162,8 @@ find . -name "*.go" \
-print |\
xargs sed -i 's/github.com\/docker\/docker\/vendor\/src\/code.google.com\/p\/go\/src\/pkg\///g'
sed -i 's/go-md2man -in "$FILE" -out/pandoc -s -t man "$FILE" -o/g' docs/man/md2man-all.sh
+%patch0 -p1
+rm daemon/daemon.go.orig
%build
# set up temporary build gopath, and put our directory there
@@ -192,8 +195,8 @@ install -d %{buildroot}%{_mandir}/man5
install -p -m 644 docs/man/man5/Dockerfile.5 %{buildroot}%{_mandir}/man5
# install bash completion
-install -d %{buildroot}%{_sysconfdir}/bash_completion.d
-install -p -m 644 contrib/completion/bash/docker %{buildroot}%{_sysconfdir}/bash_completion.d/docker.bash
+install -dp %{buildroot}%{_datadir}/bash_completion/completions
+install -p -m 644 contrib/completion/bash/docker %{buildroot}%{_datadir}/bash_completion/completions
# install zsh completion
# this has been included in upstream zsh, will be removed once it's included
@@ -223,6 +226,7 @@ install -p -m 644 contrib/init/systemd/docker.socket %{buildroot}%{_unitdir}
# for additional args
install -d %{buildroot}%{_sysconfdir}/sysconfig/
install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/docker
+install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/docker-storage
# sources
install -d -p %{buildroot}/%{gopath}/src/%{import_path}
@@ -250,6 +254,7 @@ exit 0
%doc AUTHORS CHANGELOG.md CONTRIBUTING.md LICENSE MAINTAINERS NOTICE README.md
%doc LICENSE-vim-syntax README-vim-syntax.md
%config(noreplace) %{_sysconfdir}/sysconfig/docker
+%config(noreplace) %{_sysconfdir}/sysconfig/docker-storage
%{_mandir}/man1/docker*.1.gz
%{_mandir}/man5/Dockerfile.5.gz
%{_bindir}/docker
@@ -257,8 +262,8 @@ exit 0
%{_libexecdir}/docker/dockerinit
%{_unitdir}/docker.service
%{_unitdir}/docker.socket
-%dir %{_sysconfdir}/bash_completion.d
-%{_sysconfdir}/bash_completion.d/docker.bash
+%dir %{_datadir}/bash_completion/completions
+%{_datadir}/bash_completion/completions/docker
%{_datadir}/zsh/site-functions/_docker
%dir %{_sharedstatedir}/docker
%dir %{_sysconfdir}/udev/rules.d
@@ -459,6 +464,14 @@ exit 0
%{gopath}/src/%{import_path}/pkg/version/*.go
%changelog
+* Thu Sep 25 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.2.0-3
+- Resolves: rhbz#1145660 - support /etc/sysconfig/docker-storage
+ From: Colin Walters <walters(a)redhat.com>
+- patch to ignore selinux if it's disabled
+ https://github.com/docker/docker/commit/9e2eb0f1cc3c4ef000e139f1d85a20f0e...
+ From: Dan Walsh <dwalsh(a)redhat.com>
+- Resolves: rhbz#1139415 - correct path for bash completion
+
* Sun Aug 24 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.2.0-2
- Provides docker only for f21 and above
diff --git a/docker-storage.sysconfig b/docker-storage.sysconfig
new file mode 100644
index 0000000..3dc1654
--- /dev/null
+++ b/docker-storage.sysconfig
@@ -0,0 +1,14 @@
+# This file may be automatically generated by an installation program.
+
+# By default, Docker uses a loopback-mounted sparse file in
+# /var/lib/docker. The loopback makes it slower, and there are some
+# restrictive defaults, such as 100GB max storage.
+
+# If your installation did not set a custom storage for Docker, you
+# may do it below.
+
+# Example: Use a custom pair of raw logical volumes (one for metadata,
+# one for data).
+# DOCKER_STORAGE_OPTIONS = --storage-opt dm.metadatadev=/dev/mylogvol/my-docker-metadata --storage-opt dm.datadev=/dev/mylogvol/my-docker-data
+
+DOCKER_STORAGE_OPTIONS=
diff --git a/docker.service b/docker.service
index 9b6c614..100e824 100644
--- a/docker.service
+++ b/docker.service
@@ -7,7 +7,8 @@ Requires=docker.socket
[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/docker
-ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS
+EnvironmentFile=-/etc/sysconfig/docker-storage
+ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS $DOCKER_STORAGE_OPTIONS
LimitNOFILE=1048576
LimitNPROC=1048576
diff --git a/ignore-selinux-if-disabled.patch b/ignore-selinux-if-disabled.patch
new file mode 100644
index 0000000..42630fe
--- /dev/null
+++ b/ignore-selinux-if-disabled.patch
@@ -0,0 +1,54 @@
+From 9e2eb0f1cc3c4ef000e139f1d85a20f0e00971e6 Mon Sep 17 00:00:00 2001
+From: Dan Walsh <dwalsh(a)redhat.com>
+Date: Tue, 23 Sep 2014 07:46:02 -0400
+Subject: [PATCH] --selinux-enabled flag should be ignored on Disabled SELinux
+ systems
+
+On Fedora and RHEL we ship selinux-enabled flag in the docker.service config,
+but if people setup the /var/lib/docker as btrfs and disable SELinux,
+we should not block the daemon from running.
+
+Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh(a)redhat.com> (github: rhatdan)
+---
+ daemon/daemon.go | 2 +-
+ daemon/utils_linux.go | 4 ++++
+ daemon/utils_nolinux.go | 4 ++++
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/daemon/daemon.go b/daemon/daemon.go
+index 9515a1a..bf78f10 100644
+--- a/daemon/daemon.go
++++ b/daemon/daemon.go
+@@ -775,7 +775,7 @@ func NewDaemonFromDirectory(config *Config, eng *engine.Engine) (*Daemon, error)
+ log.Debugf("Using graph driver %s", driver)
+
+ // As Docker on btrfs and SELinux are incompatible at present, error on both being enabled
+- if config.EnableSelinuxSupport && driver.String() == "btrfs" {
++ if selinuxEnabled() && config.EnableSelinuxSupport && driver.String() == "btrfs" {
+ return nil, fmt.Errorf("SELinux is not supported with the BTRFS graph driver!")
+ }
+
+diff --git a/daemon/utils_linux.go b/daemon/utils_linux.go
+index bff2a78..fb35152 100644
+--- a/daemon/utils_linux.go
++++ b/daemon/utils_linux.go
+@@ -11,3 +11,7 @@ func selinuxSetDisabled() {
+ func selinuxFreeLxcContexts(label string) {
+ selinux.FreeLxcContexts(label)
+ }
++
++func selinuxEnabled() bool {
++ return selinux.SelinuxEnabled()
++}
+diff --git a/daemon/utils_nolinux.go b/daemon/utils_nolinux.go
+index 399376d..25a56ad 100644
+--- a/daemon/utils_nolinux.go
++++ b/daemon/utils_nolinux.go
+@@ -7,3 +7,7 @@ func selinuxSetDisabled() {
+
+ func selinuxFreeLxcContexts(label string) {
+ }
++
++func selinuxEnabled() bool {
++ return false
++}
9 years, 7 months
[docker-io] Resolves: rhbz#1145660, rhbz#1139415
by Lokesh Mandvekar
commit 9110e1686c6c4b465d2502e8ef57e66effc24622
Author: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
Date: Thu Sep 25 14:35:55 2014 -0500
Resolves: rhbz#1145660, rhbz#1139415
NVR: docker-io-1.2.0-3
rhbz#1145660: support for /etc/sysconfig/docker-storage
rhbz#1139415: correct bash completion install path
Also ignores selinux if disabled.
https://github.com/docker/docker/commit/9e2eb0f1cc3c4ef000e139f1d85a20f0e...
Signed-off-by: Lokesh Mandvekar <lsm5(a)fedoraproject.org>
modified: docker-io.spec
new file: docker-storage.sysconfig
modified: docker.service
new file: ignore-selinux-if-disabled.patch
docker-io.spec | 25 +++++++++++++----
docker-storage.sysconfig | 14 ++++++++++
docker.service | 3 +-
ignore-selinux-if-disabled.patch | 54 ++++++++++++++++++++++++++++++++++++++
4 files changed, 89 insertions(+), 7 deletions(-)
---
diff --git a/docker-io.spec b/docker-io.spec
index e62fe40..1a4576a 100644
--- a/docker-io.spec
+++ b/docker-io.spec
@@ -11,7 +11,7 @@
Name: docker-io
Version: 1.2.0
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: Automates deployment of containerized applications
License: ASL 2.0
URL: http://www.docker.com
@@ -20,9 +20,10 @@ ExclusiveArch: x86_64
Source0: https://github.com/docker/docker/archive/v%{version}.tar.gz
Source1: docker.service
Source2: docker.sysconfig
+Source3: docker-storage.sysconfig
+Patch0: ignore-selinux-if-disabled.patch
# though final name for sysconf/sysvinit files is simply 'docker',
# having .sysvinit and .sysconfig makes things clear
-BuildRequires: gcc
BuildRequires: glibc-static
# ensure build uses golang 1.2-7 and above
# http://code.google.com/p/go/source/detail?r=a15f344a9efa35ef168c8feaa92a1...
@@ -161,6 +162,8 @@ find . -name "*.go" \
-print |\
xargs sed -i 's/github.com\/docker\/docker\/vendor\/src\/code.google.com\/p\/go\/src\/pkg\///g'
sed -i 's/go-md2man -in "$FILE" -out/pandoc -s -t man "$FILE" -o/g' docs/man/md2man-all.sh
+%patch0 -p1
+rm daemon/daemon.go.orig
%build
# set up temporary build gopath, and put our directory there
@@ -192,8 +195,8 @@ install -d %{buildroot}%{_mandir}/man5
install -p -m 644 docs/man/man5/Dockerfile.5 %{buildroot}%{_mandir}/man5
# install bash completion
-install -d %{buildroot}%{_sysconfdir}/bash_completion.d
-install -p -m 644 contrib/completion/bash/docker %{buildroot}%{_sysconfdir}/bash_completion.d/docker.bash
+install -dp %{buildroot}%{_datadir}/bash_completion/completions
+install -p -m 644 contrib/completion/bash/docker %{buildroot}%{_datadir}/bash_completion/completions
# install zsh completion
# this has been included in upstream zsh, will be removed once it's included
@@ -223,6 +226,7 @@ install -p -m 644 contrib/init/systemd/docker.socket %{buildroot}%{_unitdir}
# for additional args
install -d %{buildroot}%{_sysconfdir}/sysconfig/
install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/docker
+install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/docker-storage
# sources
install -d -p %{buildroot}/%{gopath}/src/%{import_path}
@@ -250,6 +254,7 @@ exit 0
%doc AUTHORS CHANGELOG.md CONTRIBUTING.md LICENSE MAINTAINERS NOTICE README.md
%doc LICENSE-vim-syntax README-vim-syntax.md
%config(noreplace) %{_sysconfdir}/sysconfig/docker
+%config(noreplace) %{_sysconfdir}/sysconfig/docker-storage
%{_mandir}/man1/docker*.1.gz
%{_mandir}/man5/Dockerfile.5.gz
%{_bindir}/docker
@@ -257,8 +262,8 @@ exit 0
%{_libexecdir}/docker/dockerinit
%{_unitdir}/docker.service
%{_unitdir}/docker.socket
-%dir %{_sysconfdir}/bash_completion.d
-%{_sysconfdir}/bash_completion.d/docker.bash
+%dir %{_datadir}/bash_completion/completions
+%{_datadir}/bash_completion/completions/docker
%{_datadir}/zsh/site-functions/_docker
%dir %{_sharedstatedir}/docker
%dir %{_sysconfdir}/udev/rules.d
@@ -459,6 +464,14 @@ exit 0
%{gopath}/src/%{import_path}/pkg/version/*.go
%changelog
+* Thu Sep 25 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.2.0-3
+- Resolves: rhbz#1145660 - support /etc/sysconfig/docker-storage
+ From: Colin Walters <walters(a)redhat.com>
+- patch to ignore selinux if it's disabled
+ https://github.com/docker/docker/commit/9e2eb0f1cc3c4ef000e139f1d85a20f0e...
+ From: Dan Walsh <dwalsh(a)redhat.com>
+- Resolves: rhbz#1139415 - correct path for bash completion
+
* Sun Aug 24 2014 Lokesh Mandvekar <lsm5(a)fedoraproject.org> - 1.2.0-2
- Provides docker only for f21 and above
diff --git a/docker-storage.sysconfig b/docker-storage.sysconfig
new file mode 100644
index 0000000..3dc1654
--- /dev/null
+++ b/docker-storage.sysconfig
@@ -0,0 +1,14 @@
+# This file may be automatically generated by an installation program.
+
+# By default, Docker uses a loopback-mounted sparse file in
+# /var/lib/docker. The loopback makes it slower, and there are some
+# restrictive defaults, such as 100GB max storage.
+
+# If your installation did not set a custom storage for Docker, you
+# may do it below.
+
+# Example: Use a custom pair of raw logical volumes (one for metadata,
+# one for data).
+# DOCKER_STORAGE_OPTIONS = --storage-opt dm.metadatadev=/dev/mylogvol/my-docker-metadata --storage-opt dm.datadev=/dev/mylogvol/my-docker-data
+
+DOCKER_STORAGE_OPTIONS=
diff --git a/docker.service b/docker.service
index 9b6c614..100e824 100644
--- a/docker.service
+++ b/docker.service
@@ -7,7 +7,8 @@ Requires=docker.socket
[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/docker
-ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS
+EnvironmentFile=-/etc/sysconfig/docker-storage
+ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS $DOCKER_STORAGE_OPTIONS
LimitNOFILE=1048576
LimitNPROC=1048576
diff --git a/ignore-selinux-if-disabled.patch b/ignore-selinux-if-disabled.patch
new file mode 100644
index 0000000..42630fe
--- /dev/null
+++ b/ignore-selinux-if-disabled.patch
@@ -0,0 +1,54 @@
+From 9e2eb0f1cc3c4ef000e139f1d85a20f0e00971e6 Mon Sep 17 00:00:00 2001
+From: Dan Walsh <dwalsh(a)redhat.com>
+Date: Tue, 23 Sep 2014 07:46:02 -0400
+Subject: [PATCH] --selinux-enabled flag should be ignored on Disabled SELinux
+ systems
+
+On Fedora and RHEL we ship selinux-enabled flag in the docker.service config,
+but if people setup the /var/lib/docker as btrfs and disable SELinux,
+we should not block the daemon from running.
+
+Docker-DCO-1.1-Signed-off-by: Dan Walsh <dwalsh(a)redhat.com> (github: rhatdan)
+---
+ daemon/daemon.go | 2 +-
+ daemon/utils_linux.go | 4 ++++
+ daemon/utils_nolinux.go | 4 ++++
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/daemon/daemon.go b/daemon/daemon.go
+index 9515a1a..bf78f10 100644
+--- a/daemon/daemon.go
++++ b/daemon/daemon.go
+@@ -775,7 +775,7 @@ func NewDaemonFromDirectory(config *Config, eng *engine.Engine) (*Daemon, error)
+ log.Debugf("Using graph driver %s", driver)
+
+ // As Docker on btrfs and SELinux are incompatible at present, error on both being enabled
+- if config.EnableSelinuxSupport && driver.String() == "btrfs" {
++ if selinuxEnabled() && config.EnableSelinuxSupport && driver.String() == "btrfs" {
+ return nil, fmt.Errorf("SELinux is not supported with the BTRFS graph driver!")
+ }
+
+diff --git a/daemon/utils_linux.go b/daemon/utils_linux.go
+index bff2a78..fb35152 100644
+--- a/daemon/utils_linux.go
++++ b/daemon/utils_linux.go
+@@ -11,3 +11,7 @@ func selinuxSetDisabled() {
+ func selinuxFreeLxcContexts(label string) {
+ selinux.FreeLxcContexts(label)
+ }
++
++func selinuxEnabled() bool {
++ return selinux.SelinuxEnabled()
++}
+diff --git a/daemon/utils_nolinux.go b/daemon/utils_nolinux.go
+index 399376d..25a56ad 100644
+--- a/daemon/utils_nolinux.go
++++ b/daemon/utils_nolinux.go
+@@ -7,3 +7,7 @@ func selinuxSetDisabled() {
+
+ func selinuxFreeLxcContexts(label string) {
+ }
++
++func selinuxEnabled() bool {
++ return false
++}
9 years, 7 months
