mount: allow mount only when using vfs

when using a driver different than vfs, the mount is probably in a
different mount namespace thus not accessible from the host.  Avoid
the confusion by not allowing mount when a different driver is used.

Closes: https://github.com/containers/libpod/issues/1964

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano 2018-12-12 11:56:19 +01:00
parent 8a3361f46c
commit a609e026a5
No known key found for this signature in database
GPG Key ID: E4730F97F60286ED
2 changed files with 22 additions and 0 deletions

View File

@ -34,6 +34,7 @@ var cmdsNotRequiringRootless = map[string]bool{
// If this change, please also update libpod.refreshRootless()
"login": true,
"logout": true,
"mount": true,
"kill": true,
"pause": true,
"restart": true,

View File

@ -3,9 +3,11 @@ package main
import (
js "encoding/json"
"fmt"
"os"
of "github.com/containers/libpod/cmd/podman/formats"
"github.com/containers/libpod/cmd/podman/libpodruntime"
"github.com/containers/libpod/pkg/rootless"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"github.com/urfave/cli"
@ -52,6 +54,9 @@ func mountCmd(c *cli.Context) error {
if err := validateFlags(c, mountFlags); err != nil {
return err
}
if os.Geteuid() != 0 {
rootless.SetSkipStorageSetup(true)
}
runtime, err := libpodruntime.GetRuntime(c)
if err != nil {
@ -59,6 +64,22 @@ func mountCmd(c *cli.Context) error {
}
defer runtime.Shutdown(false)
if os.Geteuid() != 0 {
if driver := runtime.GetConfig().StorageConfig.GraphDriverName; driver != "vfs" {
// Do not allow to mount a graphdriver that is not vfs if we are creating the userns as part
// of the mount command.
return fmt.Errorf("cannot mount using driver %s in rootless mode", driver)
}
became, ret, err := rootless.BecomeRootInUserNS()
if err != nil {
return err
}
if became {
os.Exit(ret)
}
}
formats := map[string]bool{
"": true,
of.JSONString: true,