oci_conmon: not make accessible dirs if not needed #4859
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
approved
|
Very cool if this works. |
giuseppe
force-pushed
the
not-change-permission-for-rundir-tmpdir
branch
from
a2f9a56 to
28a7c73
Compare
giuseppe
changed the title
giuseppe
force-pushed
the
not-change-permission-for-rundir-tmpdir
branch
from
28a7c73 to
b38a7cd
Compare
do not change the permissions mask for the rundir and the tmpdir when running a container with a user namespace and the current user is mapped inside the user namespace. The change was introduced with 849548f, that dropped the intermediate mount namespace in favor of allowing root into the user namespace to access these directories. Closes: containers#4846 Signed-off-by: Giuseppe Scrivano <[email protected]>
giuseppe
force-pushed
the
not-change-permission-for-rundir-tmpdir
branch
from
b38a7cd to
6818504
Compare
so now I remember where it was failing. If the user is not mapped inside of the user namespace, it won't have access to any temporary file we create (such as hostname, .containerenv, passwd) and the OCI runtime will fail. The correct check is to verify if the current user is mapped inside the user namespace. |
|
Huh. Neat. LGTM once this goes green. |
|
/lgtm |
openshift-ci-robot
added
the
do-not-merge/hold
|
/hold cancel |
openshift-ci-robot
removed
the
do-not-merge/hold
github-actions
bot
added
the
locked - please file new issue/PR
do not change the permissions mask for the rundir and the tmpdir when running a container with a user namespace and the current user is mapped inside the user namespace.
The change was introduced with 849548f, that dropped the intermediate mount namespace in favor of allowing root into the user namespace to access these directories.
Closes: #4846
Signed-off-by: Giuseppe Scrivano [email protected]