From c6d410cc365cf088f38a1b8cdfa840fcda8389dd Mon Sep 17 00:00:00 2001 From: Matthew Heon Date: Fri, 27 Oct 2023 08:58:38 -0400 Subject: [PATCH] Do not add powercap mask if no paths are masked This solves `--security-opt unmask=ALL` still masking the path. [NO NEW TESTS NEEDED] Can't easily test this as we do not have access to it in CI. Signed-off-by: Matthew Heon --- docs/source/markdown/options/security-opt.md | 2 +- libpod/container_internal_linux.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/source/markdown/options/security-opt.md b/docs/source/markdown/options/security-opt.md index f5a4ea2cf4..751875f97b 100644 --- a/docs/source/markdown/options/security-opt.md +++ b/docs/source/markdown/options/security-opt.md @@ -31,6 +31,6 @@ Note: Labeling can be disabled for all <<|pods/>>containers by setting label=fal for the possible mount options are specified in the **proc(5)** man page. - **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it unmasks all the paths that are masked or made read-only by default. - The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux**, **/sys/devices/virtual/powercap**. The default paths that are read-only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index 45452a9c2a..81c1d64eed 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -807,7 +807,7 @@ func (c *Container) getPlatformRunPath() (string, error) { } func (c *Container) addMaskedPaths(g *generate.Generator) { - if !c.config.Privileged { + if !c.config.Privileged && g.Config != nil && g.Config.Linux != nil && len(g.Config.Linux.MaskedPaths) > 0 { g.AddLinuxMaskedPaths("/sys/devices/virtual/powercap") } }