opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-12-09 23:27:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5349 from mheon/ensure_exec_suppgroups

Browse Source 
Ensure that exec sessions inherit supplemental groups
This commit is contained in:
OpenShift Merge Robot
2020-02-28 20:18:13 +01:00
committed by GitHub
parent 05550ed848 b41c864d56
commit 742093c2f2
4 changed files with 49 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libpod/container_api.go
View File

@@ -270,11 +270,6 @@ func (c *Container) Exec(tty, privileged bool, env map[string]string, cmd []stri
}
}()
// if the user is empty, we should inherit the user that the container is currently running with
if user == "" {
user = c.config.User
}
opts := new(ExecOptions)
opts.Cmd = cmd
opts.CapAdd = capList

5
libpod/container_internal_linux.go
View File

@@ -330,7 +330,10 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
// Add addition groups if c.config.GroupAdd is not empty
if len(c.config.Groups) > 0 {
gids, _ := lookup.GetContainerGroups(c.config.Groups, c.state.Mountpoint, nil)
gids, err := lookup.GetContainerGroups(c.config.Groups, c.state.Mountpoint, overrides)
if err != nil {
return nil, errors.Wrapf(err, "error looking up supplemental groups for container %s", c.ID())
}
for _, gid := range gids {
g.AddProcessAdditionalGid(gid)
}

25
libpod/oci_conmon_linux.go
View File

@@ -1252,18 +1252,35 @@ func prepareProcessExec(c *Container, cmd, env []string, tty bool, cwd, user, se
}
var addGroups []string
var sgids []uint32
// if the user is empty, we should inherit the user that the container is currently running with
if user == "" {
user = c.config.User
addGroups = c.config.Groups
}
overrides := c.getUserOverrides()
execUser, err := lookup.GetUserGroupInfo(c.state.Mountpoint, user, overrides)
if err != nil {
return nil, err
}
if len(addGroups) > 0 {
sgids, err = lookup.GetContainerGroups(addGroups, c.state.Mountpoint, overrides)
if err != nil {
return nil, errors.Wrapf(err, "error looking up supplemental groups for container %s exec session %s", c.ID(), sessionID)
}
}
// If user was set, look it up in the container to get a UID to use on
// the host
if user != "" {
sgids := make([]uint32, 0, len(execUser.Sgids))
for _, sgid := range execUser.Sgids {
sgids = append(sgids, uint32(sgid))
if user != "" || len(sgids) > 0 {
if user != "" {
for _, sgid := range execUser.Sgids {
sgids = append(sgids, uint32(sgid))
}
}
processUser := spec.User{
UID: uint32(execUser.Uid),