opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-07-15 03:02:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

get user and group information using securejoin and runc's user library

Browse Source 
for the purposes of performance and security, we use securejoin to contstruct
the root fs's path so that symlinks are what they appear to be and no pointing
to something naughty.

then instead of chrooting to parse /etc/passwd|/etc/group, we now use the runc user/group
methods which saves us quite a bit of performance.

Signed-off-by: baude <bbaude@redhat.com>
This commit is contained in:
baude
2018-10-25 13:39:25 -05:00
parent aa853b2091
commit 1dd7f13dfb
4 changed files with 201 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libpod/container_api.go
View File

@ -10,8 +10,8 @@ import (
"time"
"github.com/containers/libpod/libpod/driver"
"github.com/containers/libpod/pkg/chrootuser"
"github.com/containers/libpod/pkg/inspect"
"github.com/containers/libpod/pkg/lookup"
"github.com/containers/storage/pkg/stringid"
"github.com/docker/docker/daemon/caps"
"github.com/pkg/errors"
@ -292,13 +292,13 @@ func (c *Container) Exec(tty, privileged bool, env, cmd []string, user string) e
// the host
hostUser := ""
if user != "" {
uid, gid, err := chrootuser.GetUser(c.state.Mountpoint, user)
execUser, err := lookup.GetUserGroupInfo(c.state.Mountpoint, user, nil)
if err != nil {
return errors.Wrapf(err, "error getting user to launch exec session as")
return err
}
// runc expects user formatted as uid:gid
hostUser = fmt.Sprintf("%d:%d", uid, gid)
hostUser = fmt.Sprintf("%d:%d", execUser.Uid, execUser.Gid)
}
// Generate exec session ID