opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-05-20 16:47:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix default to pause in podman cp

Browse Source 
We want to default to secure when running containers as root,
in rootless, we need to change the default if the system does not
support cgroup v1.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2019-09-13 12:44:50 -04:00
parent 0079c24ec1
commit a481a1265a
2 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
cmd/podman/cp.go
View File

@ -14,6 +14,7 @@ import (
"github.com/containers/libpod/cmd/podman/libpodruntime"
"github.com/containers/libpod/libpod"
"github.com/containers/libpod/libpod/define"
"github.com/containers/libpod/pkg/cgroups"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/storage"
"github.com/containers/storage/pkg/archive"
@ -52,7 +53,7 @@ func init() {
cpCommand.Command = _cpCommand
flags := cpCommand.Flags()
flags.BoolVar(&cpCommand.Extract, "extract", false, "Extract the tar file into the destination directory.")
flags.BoolVar(&cpCommand.Pause, "pause", true, "Pause the container while copying")
flags.BoolVar(&cpCommand.Pause, "pause", copyPause(), "Pause the container while copying")
cpCommand.SetHelpTemplate(HelpTemplate())
cpCommand.SetUsageTemplate(UsageTemplate())
}
@ -480,3 +481,14 @@ func pathWithBindMountSource(m specs.Mount, path string) (string, error) {
}
return securejoin.SecureJoin(m.Source, strings.TrimPrefix(path, m.Destination))
}
func copyPause() bool {
if !remoteclient && rootless.IsRootless() {
cgroupv2, _ := cgroups.IsCgroup2UnifiedMode()
if !cgroupv2 {
logrus.Debugf("defaulting to pause==false on rootless cp in cgroupv1 systems")
return false
}
}
return true
}

2
docs/podman-cp.1.md
View File

@ -65,7 +65,7 @@ Extract the tar file into the destination directory. If the destination director
**--pause**
Pause the container while copying into it to avoid potential security issues around symlinks. Defaults to *false*.
Pause the container while copying into it to avoid potential security issues around symlinks. Defaults to *true*. On rootless containers with cgroups V1, defaults to false.
## ALTERNATIVES