opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 19:44:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #23977 from giuseppe/fix-permissions-copyup-volume-userns

Browse Source 
libpod: convert owner IDs only with :idmap
This commit is contained in:
openshift-merge-bot[bot]
2024-09-17 12:46:32 +00:00
committed by GitHub
parent bd93e1a7ce 432325236b
commit a4794bc9c6
3 changed files with 16 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libpod/container_internal_common.go
View File

@ -2918,8 +2918,10 @@ func (c *Container) fixVolumePermissions(v *ContainerNamedVolume) error {
uid := int(c.config.Spec.Process.User.UID) uid := int(c.config.Spec.Process.User.UID)
gid := int(c.config.Spec.Process.User.GID) gid := int(c.config.Spec.Process.User.GID)
idmapped := hasIdmapOption(v.Options)
// if the volume is mounted with "idmap", leave the IDs in from the current environment. // if the volume is mounted with "idmap", leave the IDs in from the current environment.
if c.config.IDMappings.UIDMap != nil && !hasIdmapOption(v.Options) { if c.config.IDMappings.UIDMap != nil && !idmapped {
p := idtools.IDPair{ p := idtools.IDPair{
UID: uid, UID: uid,
GID: gid, GID: gid,
@ -2965,7 +2967,8 @@ func (c *Container) fixVolumePermissions(v *ContainerNamedVolume) error {
if stat, ok := st.Sys().(*syscall.Stat_t); ok { if stat, ok := st.Sys().(*syscall.Stat_t); ok {
uid, gid := int(stat.Uid), int(stat.Gid) uid, gid := int(stat.Uid), int(stat.Gid)
if c.config.IDMappings.UIDMap != nil { // If the volume is idmapped then undo the conversion to obtain the desired UID/GID in the container
if c.config.IDMappings.UIDMap != nil && idmapped {
p := idtools.IDPair{ p := idtools.IDPair{
UID: uid, UID: uid,
GID: gid, GID: gid,

9
libpod/runtime_ctr.go
View File

@ -513,16 +513,11 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
volOptions = append(volOptions, withSetAnon()) volOptions = append(volOptions, withSetAnon())
} }
needsChown := true
// If volume-opts are set, parse and add driver opts. // If volume-opts are set, parse and add driver opts.
if len(vol.Options) > 0 { if len(vol.Options) > 0 {
isDriverOpts := false isDriverOpts := false
driverOpts := make(map[string]string) driverOpts := make(map[string]string)
for _, opts := range vol.Options { for _, opts := range vol.Options {
if opts == "idmap" {
needsChown = false
}
if strings.HasPrefix(opts, "volume-opt") { if strings.HasPrefix(opts, "volume-opt") {
isDriverOpts = true isDriverOpts = true
driverOptKey, driverOptValue, err := util.ParseDriverOpts(opts) driverOptKey, driverOptValue, err := util.ParseDriverOpts(opts)
@ -538,11 +533,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
} }
} }
if needsChown {
volOptions = append(volOptions, WithVolumeUID(ctr.RootUID()), WithVolumeGID(ctr.RootGID())) volOptions = append(volOptions, WithVolumeUID(ctr.RootUID()), WithVolumeGID(ctr.RootGID()))
} else {
volOptions = append(volOptions, WithVolumeNoChown())
}
_, err = r.newVolume(ctx, false, volOptions...) _, err = r.newVolume(ctx, false, volOptions...)
if err != nil { if err != nil {

11
test/system/030-run.bats
View File

@ -1372,18 +1372,23 @@ EOF
run_podman run --security-opt label=disable --uidmap=0:1000:200 --rm --rootfs "$romount:idmap=uids=@2000-1-1;gids=@2000-1-1" stat -c %u:%g /testfile run_podman run --security-opt label=disable --uidmap=0:1000:200 --rm --rootfs "$romount:idmap=uids=@2000-1-1;gids=@2000-1-1" stat -c %u:%g /testfile
is "$output" "1:1" is "$output" "1:1"
# verify that copyup with an empty idmap volume maintains the original ownership with different mappings and --rootfs
myvolume=my-volume-$(safename) myvolume=my-volume-$(safename)
run_podman volume create $myvolume run_podman volume create $myvolume
mkdir $romount/volume mkdir $romount/volume
chown 1000:1000 $romount/volume chown 1000:1000 $romount/volume
run_podman run --security-opt label=disable --rm --uidmap=0:1000:10000 -v $myvolume:/volume:idmap --rootfs $romount stat -c %u:%g /volume for FROM in 1000 2000; do
run_podman run --security-opt label=disable --rm --uidmap=0:$FROM:10000 -v $myvolume:/volume:idmap --rootfs $romount stat -c %u:%g /volume
is "$output" "0:0" is "$output" "0:0"
done
run_podman volume rm $myvolume run_podman volume rm $myvolume
# verify that copyup with an idmap volume maintains the original ownership # verify that copyup with an empty idmap volume maintains the original ownership with different mappings
myvolume=my-volume-$(safename) myvolume=my-volume-$(safename)
run_podman run --rm --uidmap=0:1000:10000 -v $myvolume:/etc:idmap $IMAGE stat -c %u:%g /etc/passwd for FROM in 1000 2000; do
run_podman run --rm --uidmap=0:$FROM:10000 -v $myvolume:/etc:idmap $IMAGE stat -c %u:%g /etc/passwd
is "$output" "0:0" is "$output" "0:0"
done
run_podman volume rm $myvolume run_podman volume rm $myvolume
rm -rf $romount rm -rf $romount