opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-02 10:46:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Tighten the security on the podman varlink socket

Browse Source 
We only want root to be allowed to access this socket.
Also move socket to /run/podman directory.  This requires
us to drop a podman.conf tmpfiles.d file.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #806
Approved by: mheon
This commit is contained in:
Daniel J Walsh
2018-05-18 16:28:51 -04:00
committed by Atomic Bot
parent 4b804e8516
commit 9d7c50aa03
6 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -15,6 +15,7 @@ MANDIR ?= ${PREFIX}/share/man
SHAREDIR_CONTAINERS ?= ${PREFIX}/share/containers
ETCDIR ?= ${DESTDIR}/etc
ETCDIR_LIBPOD ?= ${ETCDIR}/crio
TMPFILESDIR ?= ${PREFIX}/lib/tmpfiles.d
SYSTEMDDIR ?= ${PREFIX}/lib/systemd/system
BUILDTAGS ?= seccomp $(shell hack/btrfs_tag.sh) $(shell hack/libdm_tag.sh) $(shell hack/btrfs_installed_tag.sh) $(shell hack/ostree_tag.sh) $(shell hack/selinux_tag.sh)
PYTHON ?= /usr/bin/python3
@ -208,6 +209,7 @@ install.docker: docker-docs
install.systemd:
install ${SELINUXOPT} -m 644 -D contrib/varlink/io.projectatomic.podman.socket ${SYSTEMDDIR}/io.projectatomic.podman.socket
install ${SELINUXOPT} -m 644 -D contrib/varlink/io.projectatomic.podman.service ${SYSTEMDDIR}/io.projectatomic.podman.service
install ${SELINUXOPT} -m 644 -D contrib/varlink/podman.conf ${TMPFILESDIR}/podman.conf
uninstall:
for i in $(filter %.1,$(MANPAGES)); do \

1
contrib/spec/podman.spec.in
View File

@ -469,6 +469,7 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
%config(noreplace) %{_sysconfdir}/cni/net.d/87-%{name}-bridge.conflist
%{_unitdir}/io.%{project}.%{name}.service
%{_unitdir}/io.%{project}.%{name}.socket
%{_tmpfilesdir}/%{name}.conf
%if 0%{?fedora} >= 28
%files -n python3-%{name}

5
contrib/varlink/io.projectatomic.podman.service
View File

@ -1,11 +1,12 @@
[Unit]
Description=Pod Manager
Description=Podman Remote API Service
Requires=io.projectatomic.podman.socket
After=io.projectatomic.podman.socket
Documentation=man:podman-varlink(1)
[Service]
Type=simple
ExecStart=/usr/bin/podman varlink unix:/run/io.projectatomic.podman
ExecStart=/usr/bin/podman varlink unix:/run/podman/io.projectatomic.podman
[Install]
WantedBy=multi-user.target

6
contrib/varlink/io.projectatomic.podman.socket
View File

@ -1,8 +1,10 @@
[Unit]
Description=Pod Manager Socket
Description=Podman Remote API Socket
Documentation=man:podman-varlink(1)
[Socket]
ListenStream=/run/io.projectatomic.podman
ListenStream=/run/podman/io.projectatomic.podman
SocketMode=0600
[Install]
WantedBy=sockets.target

1
contrib/varlink/podman.conf Normal file
View File

@ -0,0 +1 @@
d /run/podman 0700 root root

10
docs/podman-varlink.1.md
View File

@ -31,8 +31,16 @@ More will go here as the docs and api firm up.
as well.
-->
## CONFIGURATION
Users of the podman varlink service should enable the io.projectatomic.podman.socket and io.projectatomic.podman.service.
You can do this via systemctl
systemctl enable --now io.projectatomic.podman.socket
## SEE ALSO
podman(1)
podman(1), systemctl(1)
## HISTORY
April 2018, Originally compiled by Brent Baude<bbaude@redhat.com>