Docker-mailserver: SELinux Fix?

[omarc1492]

I have an issue with this line when SELinux is on.

https://github.com/tomav/docker-mailserver/blob/108bdbd46361b23671b11940cf5827a98f6975b0/setup.sh#L169

Editing the script and adding :Z fixes the issue.
-v "${CONFIG_PATH}":/tmp/docker-mailserver:Z \

I would do a PR but unsure of the best way to detect SELinux running.

[englbery]

Here you go :)

https://linux.die.net/man/8/selinuxenabled

[wernerfred]

TIL about the Z option for docker volume mounts. Thanks for that :)
But a quick research showed me the following:

The z option indicates that the bind mount content is shared among multiple containers. The Z option indicates that the bind mount content is private and unshared. Use extreme caution with these options. Bind-mounting a system directory such as /home or /usr with the Z option renders your host machine inoperable and you may need to relabel the host machine files by hand. source

So i don't know if its safe to add this option by default. What do you think?

[omarc1492]

Z essentially does the same thing as would chcon -Rt svirt_sandbox_file_t.
I see that something similar was mentioned in issue #1098, but yeah you would not want to label certain directories like that.

From Docker documentation, https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label

[erik-wramner]

I don't think this should go in the setup script except if enabled by an extra command line option. It feels more like something for the wiki. One suggestion is to fix this outside the container. Rather than having Docker do the chcon for you it should be possibly to just do the chcon command manually for the config folder before mounting it the first time. If that works we can document that procedure in the wiki?

[aendeavor]

After reading through this, I'm with @erik-wramner on this. Could you test this and provide a wiki entry @omarc1492 @wernerfred ?

[wernerfred]

Not using a selinux system, so it's your turn @omarc1492

[omarc1492]

I can test adding a command line entry and adding it to the wiki for setup.sh, I can also add it to README.md under "Get up and running"

[aendeavor]

Please reach back to us when you're done @omarc1492

[omarc1492]

I submitted a PR and have also updated the Wiki.