opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-07-03 09:17:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #24306 from Luap99/quadlet-root-test

Browse Source 
quadlet: do not reject RemapUsers=keep-id as root
This commit is contained in:
openshift-merge-bot[bot]
2024-10-17 14:27:07 +00:00
committed by GitHub
parent 993ecd5a05 9c6b1e20a3
commit 740f1d1fc7
2 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/systemd/quadlet/quadlet.go
View File

@ -782,7 +782,7 @@ func ConvertContainer(container *parser.UnitFile, isUser bool, unitsInfoMap map[
return nil, err return nil, err
} }
if err := handleUserMappings(container, ContainerGroup, podman, isUser, true); err != nil { if err := handleUserMappings(container, ContainerGroup, podman, true); err != nil {
return nil, err return nil, err
} }
@ -1224,7 +1224,7 @@ func ConvertKube(kube *parser.UnitFile, unitsInfoMap map[string]*UnitInfo, isUse
handleLogDriver(kube, KubeGroup, execStart) handleLogDriver(kube, KubeGroup, execStart)
handleLogOpt(kube, KubeGroup, execStart) handleLogOpt(kube, KubeGroup, execStart)
if err := handleUserMappings(kube, KubeGroup, execStart, isUser, false); err != nil { if err := handleUserMappings(kube, KubeGroup, execStart, false); err != nil {
return nil, err return nil, err
} }
@ -1613,7 +1613,7 @@ func ConvertPod(podUnit *parser.UnitFile, name string, unitsInfoMap map[string]*
"--replace", "--replace",
) )
if err := handleUserMappings(podUnit, PodGroup, execStartPre, isUser, true); err != nil { if err := handleUserMappings(podUnit, PodGroup, execStartPre, true); err != nil {
return nil, err return nil, err
} }
@ -1684,7 +1684,7 @@ func handleUser(unitFile *parser.UnitFile, groupName string, podman *PodmanCmdli
return nil return nil
} }
func handleUserMappings(unitFile *parser.UnitFile, groupName string, podman *PodmanCmdline, isUser, supportManual bool) error { func handleUserMappings(unitFile *parser.UnitFile, groupName string, podman *PodmanCmdline, supportManual bool) error {
mappingsDefined := false mappingsDefined := false
if userns, ok := unitFile.Lookup(groupName, KeyUserNS); ok && len(userns) > 0 { if userns, ok := unitFile.Lookup(groupName, KeyUserNS); ok && len(userns) > 0 {
@ -1724,10 +1724,10 @@ func handleUserMappings(unitFile *parser.UnitFile, groupName string, podman *Pod
return nil return nil
} }
return handleUserRemap(unitFile, groupName, podman, isUser, supportManual) return handleUserRemap(unitFile, groupName, podman, supportManual)
} }
func handleUserRemap(unitFile *parser.UnitFile, groupName string, podman *PodmanCmdline, isUser, supportManual bool) error { func handleUserRemap(unitFile *parser.UnitFile, groupName string, podman *PodmanCmdline, supportManual bool) error {
uidMaps := unitFile.LookupAllStrv(groupName, KeyRemapUid) uidMaps := unitFile.LookupAllStrv(groupName, KeyRemapUid)
gidMaps := unitFile.LookupAllStrv(groupName, KeyRemapGid) gidMaps := unitFile.LookupAllStrv(groupName, KeyRemapGid)
remapUsers, _ := unitFile.LookupLast(groupName, KeyRemapUsers) remapUsers, _ := unitFile.LookupLast(groupName, KeyRemapUsers)
@ -1765,10 +1765,6 @@ func handleUserRemap(unitFile *parser.UnitFile, groupName string, podman *Podman
podman.add("--userns", usernsOpts("auto", autoOpts)) podman.add("--userns", usernsOpts("auto", autoOpts))
case "keep-id": case "keep-id":
if !isUser {
return fmt.Errorf("RemapUsers=keep-id is unsupported for system units")
}
keepidOpts := make([]string, 0) keepidOpts := make([]string, 0)
if len(uidMaps) > 0 { if len(uidMaps) > 0 {
if len(uidMaps) > 1 { if len(uidMaps) > 1 {

7
test/e2e/quadlet_test.go
View File

@ -660,7 +660,12 @@ var _ = Describe("quadlet system generator", func() {
} }
// Run quadlet to convert the file // Run quadlet to convert the file
session := podmanTest.Quadlet([]string{"--user", "--no-kmsg-log", generatedDir}, quadletDir) var args []string
if isRootless() {
args = append(args, "--user")
}
args = append(args, "--no-kmsg-log", generatedDir)
session := podmanTest.Quadlet(args, quadletDir)
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(exitCode)) Expect(session).Should(Exit(exitCode))