opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-07-15 03:02:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix conflicts between privileged and other flags

Browse Source 
The `--privileged` flag does not conflict with `--group-add`
(this one was breaking Toolbox) and does not conflict with most
parts of `--security-opt` (this was breaking Openstack).

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
This commit is contained in:
Matthew Heon
2020-06-22 16:08:09 -04:00
parent 22942e392d
commit 13cfdb0742
3 changed files with 1 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/podman/containers/create.go
View File

@ -156,10 +156,6 @@ func replaceContainer(name string) error {
} }
func createInit(c *cobra.Command) error { func createInit(c *cobra.Command) error {
if c.Flag("privileged").Changed && c.Flag("security-opt").Changed {
logrus.Warn("setting security options with --privileged has no effect")
}
if c.Flag("shm-size").Changed { if c.Flag("shm-size").Changed {
cliVals.ShmSize = c.Flag("shm-size").Value.String() cliVals.ShmSize = c.Flag("shm-size").Value.String()
} }

4
pkg/specgen/container_validate.go
View File

@ -61,10 +61,6 @@ func (s *SpecGenerator) Validate() error {
// //
// ContainerSecurityConfig // ContainerSecurityConfig
// //
// groups and privileged are exclusive
if len(s.Groups) > 0 && s.Privileged {
return exclusiveOptions("Groups", "privileged")
}
// capadd and privileged are exclusive // capadd and privileged are exclusive
if len(s.CapAdd) > 0 && s.Privileged { if len(s.CapAdd) > 0 && s.Privileged {
return exclusiveOptions("CapAdd", "privileged") return exclusiveOptions("CapAdd", "privileged")

1
pkg/specgen/specgen.go
View File

@ -207,6 +207,7 @@ type ContainerSecurityConfig struct {
// - Adds all devices on the system to the container. // - Adds all devices on the system to the container.
// - Adds all capabilities to the container. // - Adds all capabilities to the container.
// - Disables Seccomp, SELinux, and Apparmor confinement. // - Disables Seccomp, SELinux, and Apparmor confinement.
// (Though SELinux can be manually re-enabled).
// TODO: this conflicts with things. // TODO: this conflicts with things.
// TODO: this does more. // TODO: this does more.
Privileged bool `json:"privileged,omitempty"` Privileged bool `json:"privileged,omitempty"`