opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-23 17:22:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #25660 from ver4a/main

Browse Source 
Fix parsing of paths for unmask
This commit is contained in:
openshift-merge-bot[bot]
2025-05-12 16:55:30 +00:00
committed by GitHub
parent 6601a0d061 7a161115f9
commit 93fd26bc58
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/specgenutil/specgen.go
View File

@ -739,9 +739,7 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", val) return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", val)
} }
case "unmask": case "unmask":
if hasVal { s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, strings.Split(val, ":")...)
s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, val)
}
case "no-new-privileges": case "no-new-privileges":
noNewPrivileges := true noNewPrivileges := true
if hasVal { if hasVal {

5
test/e2e/run_test.go
View File

@ -437,7 +437,7 @@ var _ = Describe("Podman run", func() {
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session.OutputToString()).To(BeEmpty()) Expect(session.OutputToString()).To(BeEmpty())
session = podmanTest.Podman([]string{"run", "-d", "--name=maskCtr2", "--security-opt", "unmask=/proc/acpi:/sys/firmware", ALPINE, "sleep", "200"}) session = podmanTest.Podman([]string{"run", "-d", "--name=maskCtr2", "--security-opt", "unmask=/proc/acpi:/sys/firmware:/sys/fs/cgroup", ALPINE, "sleep", "200"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(ExitCleanly()) Expect(session).Should(ExitCleanly())
session = podmanTest.Podman([]string{"exec", "maskCtr2", "ls", "/sys/firmware"}) session = podmanTest.Podman([]string{"exec", "maskCtr2", "ls", "/sys/firmware"})
@ -448,6 +448,9 @@ var _ = Describe("Podman run", func() {
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session.OutputToString()).To(Not(BeEmpty())) Expect(session.OutputToString()).To(Not(BeEmpty()))
Expect(session).Should(ExitCleanly()) Expect(session).Should(ExitCleanly())
session = podmanTest.Podman([]string{"exec", "maskCtr2", "sh", "-c", "awk '$5 ~ /\\/sys\\/fs\\/cgroup/ && $6 ~ /^rw,|,rw,|,rw$|^rw$/ { print }' /proc/self/mountinfo | grep ."})
session.WaitWithDefaultTimeout()
Expect(session).Should(ExitCleanly())
session = podmanTest.Podman([]string{"run", "-d", "--name=maskCtr3", "--security-opt", "mask=/sys/power/disk", ALPINE, "sleep", "200"}) session = podmanTest.Podman([]string{"run", "-d", "--name=maskCtr3", "--security-opt", "mask=/sys/power/disk", ALPINE, "sleep", "200"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()