summaryrefslogtreecommitdiff
path: root/man
diff options
context:
space:
mode:
authorDan Walsh <dwalsh@redhat.com>2014-01-30 16:28:02 -0500
committerDavid Strauss <david@davidstrauss.net>2014-02-04 13:33:15 -0800
commita8828ed93878b4b4866d40ebfb660e54995ff72e (patch)
tree069b43684335a229432b2fa1f7666d8e62e3e715 /man
parent483798e0770c65968bbe2b668ece293b2419f2ec (diff)
Add SELinux support to systemd-nspawn
This patch adds to new options: -Z PROCESS_LABEL This specifies the process label to run on processes run within the container. -L FILE_LABEL The file label to assign to memory file systems created within the container. For example if you wanted to wrap an container with SELinux sandbox labels, you could execute a command line the following chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
Diffstat (limited to 'man')
-rw-r--r--man/systemd-nspawn.xml29
1 files changed, 29 insertions, 0 deletions
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index bec233c1ca..08b0457d16 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -249,6 +249,27 @@
</varlistentry>
<varlistentry>
+ <term><option>-L</option></term>
+ <term><option>--file-label=</option></term>
+
+ <listitem><para>Sets the mandatory
+ access control (MAC) file label to be
+ used by tmpfs file systems in the
+ container.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-Z</option></term>
+ <term><option>--process-label=</option></term>
+
+ <listitem><para>Sets the mandatory
+ access control (MAC) label to be used by
+ processes in the container.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term><option>--uuid=</option></term>
<listitem><para>Set the specified UUID
@@ -456,6 +477,14 @@
btrfs snapshot.</para>
</refsect1>
+ <refsect1>
+ <title>Example 6</title>
+
+ <programlisting># chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
+# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh</programlisting>
+
+ <para>This runs a container with SELinux sandbox labels.</para>
+ </refsect1>
<refsect1>
<title>Exit status</title>