containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #24167 from giuseppe/improve-check-for-current-user-mapped 

libpod: hasCurrentUserMapped checks for gid too
This commit is contained in:
openshift-merge-bot[bot] 2024-10-04 16:55:13 +00:00 committed by GitHub
parent d6da198c87 e46ae46f18
commit 1f7fe1d1e8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libpod/oci_conmon_common.go
View File

@ -34,6 +34,7 @@ import (
"github.com/containers/podman/v5/pkg/specgenutil" "github.com/containers/podman/v5/pkg/specgenutil"
"github.com/containers/podman/v5/pkg/util" "github.com/containers/podman/v5/pkg/util"
"github.com/containers/podman/v5/utils" "github.com/containers/podman/v5/utils"
"github.com/containers/storage/pkg/idtools"
spec "github.com/opencontainers/runtime-spec/specs-go" spec "github.com/opencontainers/runtime-spec/specs-go"
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
"golang.org/x/sys/unix" "golang.org/x/sys/unix"
@ -172,13 +173,15 @@ func hasCurrentUserMapped(ctr *Container) bool {
if len(ctr.config.IDMappings.UIDMap) == 0 && len(ctr.config.IDMappings.GIDMap) == 0 { if len(ctr.config.IDMappings.UIDMap) == 0 && len(ctr.config.IDMappings.GIDMap) == 0 {
return true return true
} }
uid := os.Geteuid() containsID := func(id int, mappings []idtools.IDMap) bool {
for _, m := range ctr.config.IDMappings.UIDMap { for _, m := range mappings {
if uid >= m.HostID && uid < m.HostID+m.Size { if id >= m.HostID && id < m.HostID+m.Size {
return true return true
}
} }
return false
} }
return false return containsID(os.Geteuid(), ctr.config.IDMappings.UIDMap) && containsID(os.Getegid(), ctr.config.IDMappings.GIDMap)
} }
// CreateContainer creates a container. // CreateContainer creates a container.

12
test/system/170-run-userns.bats
View File

@ -169,3 +169,15 @@ EOF
run_podman run --rm --userns=auto:uidmapping=$mapping $IMAGE awk '{if($1 == 1){print $2}}' /proc/self/uid_map run_podman run --rm --userns=auto:uidmapping=$mapping $IMAGE awk '{if($1 == 1){print $2}}' /proc/self/uid_map
assert "$output" == 1 assert "$output" == 1
} }
# bats test_tags=ci:parallel
@test "podman current user not mapped in the userns" {
# both uid and gid not mapped
run_podman run --rm --uidmap 0:1:1000 $IMAGE true
# uid not mapped
run_podman run --rm --uidmap 0:1:1000 --gidmap 0:0:1000 $IMAGE true
# gid not mapped
run_podman run --rm --uidmap 0:0:1000 --gidmap 0:1:1000 $IMAGE true
}