mirror of https://github.com/containers/podman.git
mount: allow mount only when using vfs
when using a driver different than vfs, the mount is probably in a different mount namespace thus not accessible from the host. Avoid the confusion by not allowing mount when a different driver is used. Closes: https://github.com/containers/libpod/issues/1964 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
parent
8a3361f46c
commit
a609e026a5
|
@ -34,6 +34,7 @@ var cmdsNotRequiringRootless = map[string]bool{
|
|||
// If this change, please also update libpod.refreshRootless()
|
||||
"login": true,
|
||||
"logout": true,
|
||||
"mount": true,
|
||||
"kill": true,
|
||||
"pause": true,
|
||||
"restart": true,
|
||||
|
|
|
@ -3,9 +3,11 @@ package main
|
|||
import (
|
||||
js "encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
of "github.com/containers/libpod/cmd/podman/formats"
|
||||
"github.com/containers/libpod/cmd/podman/libpodruntime"
|
||||
"github.com/containers/libpod/pkg/rootless"
|
||||
"github.com/pkg/errors"
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/urfave/cli"
|
||||
|
@ -52,6 +54,9 @@ func mountCmd(c *cli.Context) error {
|
|||
if err := validateFlags(c, mountFlags); err != nil {
|
||||
return err
|
||||
}
|
||||
if os.Geteuid() != 0 {
|
||||
rootless.SetSkipStorageSetup(true)
|
||||
}
|
||||
|
||||
runtime, err := libpodruntime.GetRuntime(c)
|
||||
if err != nil {
|
||||
|
@ -59,6 +64,22 @@ func mountCmd(c *cli.Context) error {
|
|||
}
|
||||
defer runtime.Shutdown(false)
|
||||
|
||||
if os.Geteuid() != 0 {
|
||||
if driver := runtime.GetConfig().StorageConfig.GraphDriverName; driver != "vfs" {
|
||||
// Do not allow to mount a graphdriver that is not vfs if we are creating the userns as part
|
||||
// of the mount command.
|
||||
return fmt.Errorf("cannot mount using driver %s in rootless mode", driver)
|
||||
}
|
||||
|
||||
became, ret, err := rootless.BecomeRootInUserNS()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if became {
|
||||
os.Exit(ret)
|
||||
}
|
||||
}
|
||||
|
||||
formats := map[string]bool{
|
||||
"": true,
|
||||
of.JSONString: true,
|
||||
|
|
Loading…
Reference in New Issue