opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-07-30 20:02:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

Tmpfs should not be mounted noexec

Browse Source 
The logic here makes little sense, basically the /tmp and /var/tmp are
always set noexec, while /run is not.  I don't see a reason to set any
of the three noexec by default.

Fixes: https://github.com/containers/podman/issues/19886

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2023-09-07 07:45:45 -04:00
parent c11ac807f9
commit 2d7d8d1d10
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/specgen/generate/storage.go
View File

@ -462,9 +462,6 @@ func addReadWriteTmpfsMounts(mounts map[string]spec.Mount, volumes []*specgen.Na
Source: define.TypeTmpfs,
Options: options,
}
if dest != runPath {
mnt.Options = append(mnt.Options, "noexec")
}
mounts[dest] = mnt
}
return mounts

14
test/system/700-play.bats
View File

@ -281,7 +281,7 @@ EOF
# will spin for indeterminate time.
run_podman create --pod new:pod1 --restart=no --name test1 $IMAGE touch /testrw
run_podman create --pod pod1 --read-only --restart=no --name test2 $IMAGE touch /testro
run_podman create --pod pod1 --read-only --restart=no --name test3 $IMAGE touch /tmp/testtmp
run_podman create --pod pod1 --read-only --restart=no --name test3 $IMAGE sh -c "echo "#!echo hi" > /tmp/testtmp; chmod +x /tmp/test/tmp; /tmp/testtmp"
# Generate and run from yaml. (The "cat" is for debugging failures)
run_podman kube generate pod1 -f $YAML
@ -765,6 +765,18 @@ EOF
run_podman rm -a
}
@test "podman kube generate tmpfs on /tmp" {
KUBE=$PODMAN_TMPDIR/kube.yaml
run_podman create --name test $IMAGE sleep 100
run_podman kube generate test -f $KUBE
run_podman kube play $KUBE
run_podman exec test-pod-test sh -c "mount | grep /tmp"
assert "$output" !~ "noexec" "mounts on /tmp should not be noexec"
run_podman kube down $KUBE
run_podman pod rm -a -f -t 0
run_podman rm -a -f -t 0
}
@test "podman kube play - pull policy" {
skip_if_remote "pull debug logs only work locally"