opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-05-20 00:27:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

libpod: avoid chowning the rundir to root in the userns

Browse Source 
so it is possible to remove the code to make the entire directory
world accessible.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2024-06-18 23:09:55 +02:00
parent c81f075f43
commit 08a8429459
3 changed files with 0 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libpod/container_internal.go
View File

@ -544,16 +544,6 @@ func (c *Container) setupStorage(ctx context.Context) error {
c.config.StaticDir = containerInfo.Dir c.config.StaticDir = containerInfo.Dir
c.state.RunDir = containerInfo.RunDir c.state.RunDir = containerInfo.RunDir
if len(c.config.IDMappings.UIDMap) != 0 || len(c.config.IDMappings.GIDMap) != 0 {
if err := idtools.SafeChown(containerInfo.RunDir, c.RootUID(), c.RootGID()); err != nil {
return err
}
if err := idtools.SafeChown(containerInfo.Dir, c.RootUID(), c.RootGID()); err != nil {
return err
}
}
// Set the default Entrypoint and Command // Set the default Entrypoint and Command
if containerInfo.Config != nil { if containerInfo.Config != nil {
// Set CMD in the container to the default configuration only if ENTRYPOINT is not set by the user. // Set CMD in the container to the default configuration only if ENTRYPOINT is not set by the user.

4
libpod/container_internal_common.go
View File

@ -1834,10 +1834,6 @@ func (c *Container) mountIntoRootDirs(mountName string, mountPath string) error
// Make standard bind mounts to include in the container // Make standard bind mounts to include in the container
func (c *Container) makeBindMounts() error { func (c *Container) makeBindMounts() error {
if err := idtools.SafeChown(c.state.RunDir, c.RootUID(), c.RootGID()); err != nil {
return fmt.Errorf("cannot chown run directory: %w", err)
}
if c.state.BindMounts == nil { if c.state.BindMounts == nil {
c.state.BindMounts = make(map[string]string) c.state.BindMounts = make(map[string]string)
} }

5
libpod/oci_conmon_common.go
View File

@ -183,11 +183,6 @@ func hasCurrentUserMapped(ctr *Container) bool {
// CreateContainer creates a container. // CreateContainer creates a container.
func (r *ConmonOCIRuntime) CreateContainer(ctr *Container, restoreOptions *ContainerCheckpointOptions) (int64, error) { func (r *ConmonOCIRuntime) CreateContainer(ctr *Container, restoreOptions *ContainerCheckpointOptions) (int64, error) {
// always make the container directory accessible to the current user so that the PID files can be read without
// being in the rootless user namespace.
if err := makeAccessible(ctr.state.RunDir, 0, 0); err != nil {
return 0, err
}
if !hasCurrentUserMapped(ctr) { if !hasCurrentUserMapped(ctr) {
if err := makeAccessible(ctr.state.Mountpoint, ctr.RootUID(), ctr.RootGID()); err != nil { if err := makeAccessible(ctr.state.Mountpoint, ctr.RootUID(), ctr.RootGID()); err != nil {
return 0, err return 0, err