Upstream/harbor
1
0
Fork 0
mirror of https://github.com/goharbor/harbor.git synced 2024-12-31 21:18:21 +01:00
Code Issues Projects Releases Wiki Activity
8ab45d439b
harbor/make
History
Aron Parsons 8ab45d439b label volumes for SELinux 
allow Harbor to run when dockerd is running with --selinux-enabled

example AVC denials:
type=AVC msg=audit(1488384855.681:154671): avc:  denied  { read } for  pid=454 comm="registry" name="config.yml" dev="dm-8" ino=12583048 scontext=system_u:system_r:svirt_lxc_net_t:s0:c298,c958 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1488384855.681:154671): avc:  denied  { open } for  pid=454 comm="registry" path="/etc/registry/config.yml" dev="dm-8" ino=12583048 scontext=system_u:system_r:svirt_lxc_net_t:s0:c298,c958 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1488384855.687:154672): avc:  denied  { append } for  pid=350 comm=72733A6D61696E20513A526567 name="registry.log" dev="dm-5" ino=4315920 scontext=system_u:system_r:svirt_lxc_net_t:s0:c599,c800 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1488384856.895:154702): avc:  denied  { remove_name } for  pid=708 comm="mysqld" name="4691d4d62464.lower-test" dev="dm-12" ino=402656159 scontext=system_u:system_r:svirt_lxc_net_t:s0:c149,c797 tcontext=system_u:object_r:default_t:s0 tclass=dir
type=AVC msg=audit(1488384856.926:154703): avc:  denied  { lock } for  pid=708 comm="mysqld" path="/var/lib/mysql/ibdata1" dev="dm-12" ino=402656097 scontext=system_u:system_r:svirt_lxc_net_t:s0:c149,c797 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1488384857.958:154736): avc:  denied  { open } for  pid=924 comm="harbor_jobservi" path="/etc/jobservice/app.conf" dev="dm-8" ino=142 scontext=system_u:system_r:svirt_lxc_net_t:s0:c102,c158 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1488384858.089:154737): avc:  denied  { read } for  pid=1017 comm="nginx" name="nginx.conf" dev="dm-8" ino=4194445 scontext=system_u:system_r:svirt_lxc_net_t:s0:c847,c996 tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC msg=audit(1488384858.089:154737): avc:  denied  { open } for  pid=1017 comm="nginx" path="/etc/nginx/nginx.conf" dev="dm-8" ino=4194445 scontext=system_u:system_r:svirt_lxc_net_t:s0:c847,c996 tcontext=system_u:object_r:default_t:s0 tclass=file
2017-03-03 14:13:39 -05:00
..
common 1.fix issue: deleting repo action will fall in deadlock between two Harbor if they are configured to sync to each other 2. Filter notification request in nginx 2016-12-09 18:10:20 +08:00
dev Update for adding timestamp to JS file name to avoid browser cache. 2016-11-14 18:27:56 +08:00
kubernetes update kubernetes deployment 2017-01-16 12:06:35 +08:00
photon remove rsyslogd.pid before start to allow container restarts 2016-12-01 15:31:14 +01:00
ubuntu Update for adding timestamp to JS file name to avoid browser cache. 2016-11-14 18:27:56 +08:00
checkenv.sh update for fix #925 2016-10-24 16:51:42 +08:00
docker-compose.tpl label volumes for SELinux 2017-03-03 14:13:39 -05:00
harbor.cfg Update comment. 2016-11-24 17:50:41 +08:00
install.sh change code 20161019 2016-10-21 18:39:10 +08:00
jsminify.sh change code 20161019 2016-10-21 18:39:10 +08:00
prepare make cert dir 2016-11-17 16:14:22 +08:00
pushimage.sh change code 20161019 2016-10-21 18:39:10 +08:00