opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-20 00:51:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4329 from mheon/no_noexec_image_volume

Browse Source 
Image volumes should not be mounted noexec
This commit is contained in:
OpenShift Merge Robot
2019-10-24 01:07:51 +02:00
committed by GitHub
parent 4b8832a9af 57eaea9539
commit 299a430759
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/spec/storage.go
View File

@ -738,13 +738,13 @@ func (config *CreateConfig) getImageVolumes() (map[string]spec.Mount, map[string
Destination: cleanDest, Destination: cleanDest,
Source: TypeTmpfs, Source: TypeTmpfs,
Type: TypeTmpfs, Type: TypeTmpfs,
Options: []string{"rprivate", "rw", "nodev"}, Options: []string{"rprivate", "rw", "nodev", "exec"},
} }
mounts[vol] = mount mounts[vol] = mount
} else { } else {
// Anonymous volumes have no name. // Anonymous volumes have no name.
namedVolume := new(libpod.ContainerNamedVolume) namedVolume := new(libpod.ContainerNamedVolume)
namedVolume.Options = []string{"rprivate", "rw", "nodev"} namedVolume.Options = []string{"rprivate", "rw", "nodev", "exec"}
namedVolume.Dest = cleanDest namedVolume.Dest = cleanDest
volumes[vol] = namedVolume volumes[vol] = namedVolume
} }

7
test/e2e/run_volume_test.go
View File

@ -357,4 +357,11 @@ var _ = Describe("Podman run with volumes", func() {
Expect(len(arr2)).To(Equal(1)) Expect(len(arr2)).To(Equal(1))
Expect(arr2[0]).To(Equal(volName)) Expect(arr2[0]).To(Equal(volName))
}) })
It("podman run image volume is not noexec", func() {
session := podmanTest.Podman([]string{"run", "--rm", redis, "grep", "/data", "/proc/self/mountinfo"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(Not(ContainSubstring("noexec")))
})
}) })