podman

1
//go:build !remote
2

3
package generate
4

5
import (
6
	"github.com/containers/common/libimage"
7
	"github.com/containers/common/pkg/config"
8
	"github.com/containers/podman/v5/libpod"
9
	"github.com/containers/podman/v5/pkg/specgen"
10
	"github.com/opencontainers/runtime-tools/generate"
11
)
12

13
// setLabelOpts sets the label options of the SecurityConfig according to the
14
// input.
15
func setLabelOpts(s *specgen.SpecGenerator, runtime *libpod.Runtime, pidConfig specgen.Namespace, ipcConfig specgen.Namespace) error {
16
	return nil
17
}
18

19
func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, newImage *libimage.Image, rtc *config.Config) error {
20
	// If this is a privileged container, change the devfs ruleset to expose all devices.
21
	if s.IsPrivileged() {
22
		for k, m := range g.Config.Mounts {
23
			if m.Type == "devfs" {
24
				m.Options = []string{
25
					"ruleset=0",
26
				}
27
				g.Config.Mounts[k] = m
28
			}
29
		}
30
	}
31

32
	if s.ReadOnlyFilesystem != nil {
33
		g.SetRootReadonly(*s.ReadOnlyFilesystem)
34
	}
35

36
	return nil
37
}
38