opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-03 01:37:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

container: do not create .containerenv with -v SRC:/run

Browse Source 
if /run is on a volume do not create the file /run/.containerenv as it
would leak outside of the container.

Closes: https://github.com/containers/podman/issues/14577

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2022-06-14 10:49:14 +02:00
parent 576c739e5f
commit fcfcd4cdb1
2 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libpod/container_internal_linux.go
View File

@ -2249,8 +2249,19 @@ func (c *Container) makeBindMounts() error {
}
}
_, hasRunContainerenv := c.state.BindMounts["/run/.containerenv"]
if !hasRunContainerenv {
// check in the spec mounts
for _, m := range c.config.Spec.Mounts {
if m.Destination == "/run/.containerenv" || m.Destination == "/run" {
hasRunContainerenv = true
break
}
}
}
// Make .containerenv if it does not exist
if _, ok := c.state.BindMounts["/run/.containerenv"]; !ok {
if !hasRunContainerenv {
containerenv := c.runtime.graphRootMountedFlag(c.config.Spec.Mounts)
isRootless := 0
if rootless.IsRootless() {