rootless: rename auth-scripts to preexec-hooks

to not give a false sense of security since these are not a security
mechanism but a hook to run arbitrary code before executing a
command.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

pkg/rootless/rootless_linux.c

@@ -20,7 +20,7 @@
 #include <sys/select.h>
 #include <stdio.h>
 
-#define ETC_AUTH_SCRIPTS "/etc/containers/auth-scripts"
+#define ETC_PREEXEC_HOOKS "/etc/containers/pre-exec-hooks"
 #define LIBEXECPODMAN "/usr/libexec/podman"
 
 #ifndef TEMP_FAILURE_RETRY
@@ -164,23 +164,23 @@ exec_binary (const char *path, char **argv, int argc)
     }
   if (WIFEXITED(status) && WEXITSTATUS (status))
     {
-      fprintf (stderr, "external auth script %s failed\n", path);
+      fprintf (stderr, "external preexec hook %s failed\n", path);
       exit (WEXITSTATUS(status));
     }
   if (WIFSIGNALED (status))
     {
-      fprintf (stderr, "external auth script %s failed\n", path);
+      fprintf (stderr, "external preexec hook %s failed\n", path);
       exit (127+WTERMSIG (status));
     }
   if (WIFSTOPPED (status))
     {
-      fprintf (stderr, "external auth script %s failed\n", path);
+      fprintf (stderr, "external preexec hook %s failed\n", path);
       exit (EXIT_FAILURE);
     }
 }
 
 static void
-do_auth_scripts_dir (const char *dir, char **argv, int argc)
+do_preexec_hooks_dir (const char *dir, char **argv, int argc)
 {
   cleanup_free char *buffer = NULL;
   cleanup_dir DIR *d = NULL;
@@ -261,13 +261,13 @@ do_auth_scripts_dir (const char *dir, char **argv, int argc)
 }
 
 static void
-do_auth_scripts (char **argv, int argc)
+do_preexec_hooks (char **argv, int argc)
 {
-  char *auth_scripts = getenv ("PODMAN_AUTH_SCRIPTS_DIR");
+  char *preexec_hooks = getenv ("PODMAN_PREEXEC_HOOKS_DIR");
-  do_auth_scripts_dir (LIBEXECPODMAN "/auth-scripts", argv, argc);
+  do_preexec_hooks_dir (LIBEXECPODMAN "/pre-exec-hooks", argv, argc);
-  do_auth_scripts_dir (ETC_AUTH_SCRIPTS, argv, argc);
+  do_preexec_hooks_dir (ETC_PREEXEC_HOOKS, argv, argc);
-  if (auth_scripts && auth_scripts[0])
+  if (preexec_hooks && preexec_hooks[0])
-    do_auth_scripts_dir (auth_scripts, argv, argc);
+    do_preexec_hooks_dir (preexec_hooks, argv, argc);
 }
 
 static void
@@ -498,7 +498,7 @@ static void __attribute__((constructor)) init()
     }
 
   if (geteuid () != 0 || getenv ("_CONTAINERS_USERNS_CONFIGURED") == NULL)
-    do_auth_scripts(argv, argc);
+    do_preexec_hooks(argv, argc);
 
   listen_pid = getenv("LISTEN_PID");
   listen_fds = getenv("LISTEN_FDS");

test/system/950-auth-scripts.bats

@@ -1,33 +0,0 @@
-#!/usr/bin/env bats
-#
-# Tests for podman auth scripts
-#
-
-load helpers
-load helpers.network
-
-function setup() {
-    basic_setup
-}
-
-function teardown() {
-    basic_teardown
-}
-
-@test "podman auth script" {
-    auth_dir=$PODMAN_TMPDIR/auth
-    mkdir -p $auth_dir
-    auth_script=$auth_dir/pull_check.sh
-
-    cat > $auth_script <<EOF
-#!/bin/sh
-if echo \$@ | grep "pull foobar"; then
-    exit 42
-fi
-exit 43
-EOF
-    chmod +x $auth_script
-
-    PODMAN_AUTH_SCRIPTS_DIR=$auth_dir run_podman 42 pull foobar
-    PODMAN_AUTH_SCRIPTS_DIR=$auth_dir run_podman 43 pull barfoo
-}

test/system/950-preexec-hooks.bats

@@ -0,0 +1,33 @@
+#!/usr/bin/env bats
+#
+# Tests for podman preexec hooks
+#
+
+load helpers
+load helpers.network
+
+function setup() {
+    basic_setup
+}
+
+function teardown() {
+    basic_teardown
+}
+
+@test "podman preexec hook" {
+    preexec_hook_dir=$PODMAN_TMPDIR/auth
+    mkdir -p $preexec_hook_dir
+    preexec_hook_script=$preexec_hook_dir/pull_check.sh
+
+    cat > $preexec_hook_script <<EOF
+#!/bin/sh
+if echo \$@ | grep "pull foobar"; then
+    exit 42
+fi
+exit 43
+EOF
+    chmod +x $preexec_hook_script
+
+    PODMAN_PREEXEC_HOOKS_DIR=$preexec_hook_dir run_podman 42 pull foobar
+    PODMAN_PREEXEC_HOOKS_DIR=$preexec_hook_dir run_podman 43 pull barfoo
+}