opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-18 03:33:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #24167 from giuseppe/improve-check-for-current-user-mapped

Browse Source 
libpod: hasCurrentUserMapped checks for gid too
This commit is contained in:
openshift-merge-bot[bot]
2024-10-04 16:55:13 +00:00
committed by GitHub
parent d6da198c87 e46ae46f18
commit 1f7fe1d1e8
2 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libpod/oci_conmon_common.go
View File

@ -34,6 +34,7 @@ import (
"github.com/containers/podman/v5/pkg/specgenutil"
"github.com/containers/podman/v5/pkg/util"
"github.com/containers/podman/v5/utils"
"github.com/containers/storage/pkg/idtools"
spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/sirupsen/logrus"
"golang.org/x/sys/unix"
@ -172,13 +173,15 @@ func hasCurrentUserMapped(ctr *Container) bool {
if len(ctr.config.IDMappings.UIDMap) == 0 && len(ctr.config.IDMappings.GIDMap) == 0 {
return true
}
uid := os.Geteuid()
for _, m := range ctr.config.IDMappings.UIDMap {
if uid >= m.HostID && uid < m.HostID+m.Size {
return true
containsID := func(id int, mappings []idtools.IDMap) bool {
for _, m := range mappings {
if id >= m.HostID && id < m.HostID+m.Size {
return true
}
}
return false
}
return false
return containsID(os.Geteuid(), ctr.config.IDMappings.UIDMap) && containsID(os.Getegid(), ctr.config.IDMappings.GIDMap)
}
// CreateContainer creates a container.

12
test/system/170-run-userns.bats
View File

@ -169,3 +169,15 @@ EOF
run_podman run --rm --userns=auto:uidmapping=$mapping $IMAGE awk '{if($1 == 1){print $2}}' /proc/self/uid_map
assert "$output" == 1
}
# bats test_tags=ci:parallel
@test "podman current user not mapped in the userns" {
# both uid and gid not mapped
run_podman run --rm --uidmap 0:1:1000 $IMAGE true
# uid not mapped
run_podman run --rm --uidmap 0:1:1000 --gidmap 0:0:1000 $IMAGE true
# gid not mapped
run_podman run --rm --uidmap 0:0:1000 --gidmap 0:1:1000 $IMAGE true
}