containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14415 from nicrowe00/14133 

no-new-privileges format
This commit is contained in:
OpenShift Merge Robot 2022-05-31 05:07:28 -04:00 committed by GitHub
parent a550af260a 7e69e2b532
commit ccc087a30e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
pkg/specgenutil/specgen.go
View File

@ -622,7 +622,14 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
if opt == "no-new-privileges" { if opt == "no-new-privileges" {
s.ContainerSecurityConfig.NoNewPrivileges = true s.ContainerSecurityConfig.NoNewPrivileges = true
} else { } else {
con := strings.SplitN(opt, "=", 2) // Docker deprecated the ":" syntax but still supports it,
// so we need to as well
var con []string
if strings.Contains(opt, "=") {
con = strings.SplitN(opt, "=", 2)
} else {
con = strings.SplitN(opt, ":", 2)
}
if len(con) != 2 { if len(con) != 2 {
return fmt.Errorf("invalid --security-opt 1: %q", opt) return fmt.Errorf("invalid --security-opt 1: %q", opt)
} }
@ -650,6 +657,12 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
} }
case "unmask": case "unmask":
s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, con[1:]...) s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, con[1:]...)
case "no-new-privileges":
noNewPrivileges, err := strconv.ParseBool(con[1])
if err != nil {
return fmt.Errorf("invalid --security-opt 2: %q", opt)
}
s.ContainerSecurityConfig.NoNewPrivileges = noNewPrivileges
default: default:
return fmt.Errorf("invalid --security-opt 2: %q", opt) return fmt.Errorf("invalid --security-opt 2: %q", opt)
} }

11
test/system/030-run.bats
View File

@ -855,4 +855,15 @@ EOF
run_podman rmi $test_image run_podman rmi $test_image
} }
@test "podman create --security-opt" {
run_podman create --security-opt no-new-privileges=true $IMAGE
run_podman rm $output
run_podman create --security-opt no-new-privileges:true $IMAGE
run_podman rm $output
run_podman create --security-opt no-new-privileges=false $IMAGE
run_podman rm $output
run_podman create --security-opt no-new-privileges $IMAGE
run_podman rm $output
}
# vim: filetype=sh # vim: filetype=sh