opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 11:32:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

check --user range for rootless containers

Browse Source 
Check --user range if it's a uid for rootless containers. Returns error if it is out of the range. From https://github.com/containers/libpod/issues/6431#issuecomment-636124686

Signed-off-by: Qi Wang <qiwan@redhat.com>
This commit is contained in:
Qi Wang
2020-05-29 17:39:42 -04:00
parent f559cec6c0
commit 77e4b077b9
4 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/util/utils_linux.go
View File

@ -6,6 +6,7 @@ import (
"path/filepath"
"syscall"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/psgo"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
@ -52,3 +53,18 @@ func FindDeviceNodes() (map[string]string, error) {
return nodes, nil
}
// CheckRootlessUIDRange checks the uid within the rootless container is in the range from /etc/subuid
func CheckRootlessUIDRange(uid int) error {
uids, _, err := rootless.GetConfiguredMappings()
if err != nil {
return err
}
for _, u := range uids {
// add 1 since we also map in the user's own UID
if uid > u.Size+1 {
return errors.Errorf("requested user's UID %d is too large for the rootless user namespace", uid)
}
}
return nil
}