Controlling the context of a selinux file created on a host through the volume of a Docker container

Question

I looked at the fig python / django tutorial on Fedora 20 (docker 1.0.0), but it failed and AVC failed in SELinux when django-admin.py tried to create project files.

I looked at the policy, I see that setting the docker_var_lib_t context in my dir code allows docker to write there (although I just checked docker_share_t in a policy that looks more suitable for permissions - there are no chr / blk devices in this context).

The location of directory directories is not predictable, so setting up policies throughout the system (using the semanage text context) does not look the best; I would need to introduce some kind of agreement.

Is there a way to automatically set this context on volumes mounted from the host?

Answer 1

You can set the following context in the directory

chcon -Rt svirt_sandbox_file_t $ HOME / code / export

then run docker command as

docker run --rm -it -v $ HOME / code / export: / exported: ro image / foo / bar