opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 19:44:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

[v4.0-rhel] container: do not create .containerenv with -v SRC:/run

Browse Source 
if /run is on a volume do not create the file /run/.containerenv as it
would leak outside of the container.

Closes: https://github.com/containers/podman/issues/14577

Backporting #14582 to v4.0-rhel to complete the backports to https://issues.redhat.com/browse/OCPBUGS-7522

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Tom Sweeney <tsweeney@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2022-06-14 10:49:14 +02:00
committed by Tom Sweeney
parent d54ecc8c3b
commit febde1a23f
2 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libpod/container_internal_linux.go
View File

@ -1939,8 +1939,19 @@ func (c *Container) makeBindMounts() error {
}
}
_, hasRunContainerenv := c.state.BindMounts["/run/.containerenv"]
if !hasRunContainerenv {
// check in the spec mounts
for _, m := range c.config.Spec.Mounts {
if m.Destination == "/run/.containerenv" || m.Destination == "/run" {
hasRunContainerenv = true
break
}
}
}
// Make .containerenv if it does not exist
if _, ok := c.state.BindMounts["/run/.containerenv"]; !ok {
if !hasRunContainerenv {
containerenv := c.runtime.graphRootMountedFlag(c.config.Spec.Mounts)
isRootless := 0
if rootless.IsRootless() {

14
test/e2e/run_volume_test.go
View File

@ -828,6 +828,20 @@ USER testuser`, fedoraMinimal)
Expect(session.OutputToString()).To(Equal(perms))
})
It("podman run with -v $SRC:/run does not create /run/.containerenv", func() {
mountSrc := filepath.Join(podmanTest.TempDir, "vol-test1")
err := os.MkdirAll(mountSrc, 0755)
Expect(err).To(BeNil())
session := podmanTest.Podman([]string{"run", "-v", mountSrc + ":/run", ALPINE, "true"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
// the file should not have been created
_, err = os.Stat(filepath.Join(mountSrc, ".containerenv"))
Expect(err).To(Not(BeNil()))
})
It("podman volume with uid and gid works", func() {
volName := "testVol"
volCreate := podmanTest.Podman([]string{"volume", "create", "--opt", "o=uid=1000", volName})