Check filecaps on newuidmap and newgidmap on failure #1188
Conversation
|
Fixes: containers/podman#13751 |
There was a problem hiding this comment.
Podman doesn't use this code AFAIK.
You need to change https://github.com/containers/podman/blob/839744af56ee6a3e54c63eb8da495974666dfdeb/pkg/rootless/rootless_linux.go#L115 for podman.
pkg/unshare/unshare_linux.go
Outdated
| return cap.Get(capability.EFFECTIVE, capability.CAP_SETUID), nil | ||
| } | ||
|
|
||
| func isSetGid(path string) (bool, error) { |
There was a problem hiding this comment.
Can you combine isSetUid() and isSetGid() into one function, right now the logic is duplicated, i.e.
modeSetid := os.ModeSetuid
capSetid := capability.CAP_SETGID
if gid {
modeSetid := os.ModeSetuid
capSetid := capability.CAP_SETGID
}
pkg/unshare/unshare_linux.go
Outdated
| if mode&modeid == modeid { | ||
| return true, nil | ||
| } | ||
| cap, err := capability.NewFile(path) |
There was a problem hiding this comment.
The docs for github.com/syndtr/gocapability/capability say NewFile() is deprecated, and to use NewFile2() and then cap.Load() instead.
There was a problem hiding this comment.
I had that on a previous version.
pkg/unshare/unshare_linux.go
Outdated
| @@ -76,6 +78,26 @@ func getRootlessGID() int { | |||
| return os.Getegid() | |||
| } | |||
|
|
|||
| func isSetID(path string, modeid fs.FileMode, capid capability.Cap) (bool, error) { | |||
There was a problem hiding this comment.
It's okay to call modeid a os.FileMode.
There was a problem hiding this comment.
Now you just want to aggravate me....
There was a problem hiding this comment.
Trying to get you past the linter, which seems to not understand that package name.
A fairly common failure is newuidmap and newgidmap not being setuid and setgid. If these commands fail, check the permissions on the binaries in order to give the user better information on why they failed. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
|
LGTM |
A fairly common failure is newuidmap and newgidmap not being setuid and
setgid. If these commands fail, check the permissions on the binaries in
order to give the user better information on why they failed.
Signed-off-by: Daniel J Walsh dwalsh@redhat.com