opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 11:32:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

podman: implement userns=keep-id

Browse Source 
add missing implementation for userns=keep-id and enable the user
namespaces tests.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2020-04-24 14:54:43 +02:00
parent 81c7a2444c
commit 64d8b4eebb
5 changed files with 87 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
pkg/specgen/generate/namespaces.go
View File

@ -10,6 +10,7 @@ import (
"github.com/containers/libpod/pkg/cgroups"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/libpod/pkg/specgen"
"github.com/containers/libpod/pkg/util"
spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/runtime-tools/generate"
"github.com/pkg/errors"
@ -175,6 +176,13 @@ func GenerateNamespaceOptions(s *specgen.SpecGenerator, rt *libpod.Runtime, pod
// User
switch s.UserNS.NSMode {
case specgen.KeepID:
if rootless.IsRootless() {
s.User = ""
} else {
// keep-id as root doesn't need a user namespace
s.UserNS.NSMode = specgen.Host
}
case specgen.FromPod:
if pod == nil || infraCtr == nil {
return nil, errNoInfra
@ -378,6 +386,18 @@ func specConfigureNamespaces(s *specgen.SpecGenerator, g *generate.Generator, rt
if err := g.RemoveLinuxNamespace(string(spec.UserNamespace)); err != nil {
return err
}
case specgen.KeepID:
var (
err error
uid, gid int
)
s.IDMappings, uid, gid, err = util.GetKeepIDMapping()
if err != nil {
return err
}
g.SetProcessUID(uint32(uid))
g.SetProcessGID(uint32(gid))
fallthrough
case specgen.Private:
if err := g.AddOrReplaceLinuxNamespace(string(spec.UserNamespace), ""); err != nil {
return err