opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-05-17 15:18:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix parsing of paths for unmask

Browse Source 
This fixes an issue where multiple paths separated by a colon were
treated as a single path, contrary to what docs say and unlike how mask
option works.

Test was updated with a case that fails without this commit.

Signed-off-by: Šimon Škoda <ver4a@uncontrol.me>
This commit is contained in:
Šimon Škoda
2025-05-09 11:22:12 +00:00
committed by ver4a
parent e138304f33
commit 7a161115f9
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/specgenutil/specgen.go
View File

@ -739,9 +739,7 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", val)
}
case "unmask":
if hasVal {
s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, val)
}
s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, strings.Split(val, ":")...)
case "no-new-privileges":
noNewPrivileges := true
if hasVal {