containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rootless: attempt to join all specified paths 

when there are multiple paths specified, attempt to join them all
before returning an error.  Previously we were failing on the first
pid found.

[NO NEW TESTS NEEDED]

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano 2022-06-17 14:16:21 +02:00
parent 9afd5e31c8
commit ecf225019a
No known key found for this signature in database
GPG Key ID: 67E38F7A8BA21772
2 changed files with 22 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/domain/infra/abi/system.go
View File

@ -125,8 +125,14 @@ func (ic *ContainerEngine) SetupRootless(_ context.Context, noMoveProcess bool)
paths = append(paths, ctr.Config().ConmonPidFile) paths = append(paths, ctr.Config().ConmonPidFile)
} }
became, ret, err = rootless.TryJoinFromFilePaths(pausePidPath, true, paths) if len(paths) > 0 {
utils.MovePauseProcessToScope(pausePidPath) became, ret, err = rootless.TryJoinFromFilePaths(pausePidPath, true, paths)
} else {
became, ret, err = rootless.BecomeRootInUserNS(pausePidPath)
if err == nil {
utils.MovePauseProcessToScope(pausePidPath)
}
}
if err != nil { if err != nil {
logrus.Error(errors.Wrapf(err, "invalid internal status, try resetting the pause process with %q", os.Args[0]+" system migrate")) logrus.Error(errors.Wrapf(err, "invalid internal status, try resetting the pause process with %q", os.Args[0]+" system migrate"))
os.Exit(1) os.Exit(1)

33
pkg/rootless/rootless_linux.go
View File

@ -461,13 +461,8 @@ func BecomeRootInUserNS(pausePid string) (bool, int, error) {
// different uidmap and the unprivileged user has no way to read the // different uidmap and the unprivileged user has no way to read the
// file owned by the root in the container. // file owned by the root in the container.
func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []string) (bool, int, error) { func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []string) (bool, int, error) {
if len(paths) == 0 {
return BecomeRootInUserNS(pausePidPath)
}
var lastErr error var lastErr error
var pausePid int var pausePid int
foundProcess := false
for _, path := range paths { for _, path := range paths {
if !needNewNamespace { if !needNewNamespace {
@ -479,12 +474,9 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
pausePid, err = strconv.Atoi(string(data)) pausePid, err = strconv.Atoi(string(data))
if err != nil { if err != nil {
lastErr = errors.Wrapf(err, "cannot parse file %s", path) lastErr = errors.Wrapf(err, "cannot parse file %q", path)
continue continue
} }
lastErr = nil
break
} else { } else {
r, w, err := os.Pipe() r, w, err := os.Pipe()
if err != nil { if err != nil {
@ -511,26 +503,29 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
n, err := r.Read(b) n, err := r.Read(b)
if err != nil { if err != nil {
lastErr = errors.Wrapf(err, "cannot read %s\n", path) lastErr = errors.Wrapf(err, "cannot read %q", path)
continue continue
} }
pausePid, err = strconv.Atoi(string(b[:n])) pausePid, err = strconv.Atoi(string(b[:n]))
if err == nil && unix.Kill(pausePid, 0) == nil { if err != nil {
foundProcess = true lastErr = err
lastErr = nil continue
break
} }
} }
}
if !foundProcess && pausePidPath != "" { if pausePid > 0 && unix.Kill(pausePid, 0) == nil {
return BecomeRootInUserNS(pausePidPath) joined, pid, err := joinUserAndMountNS(uint(pausePid), pausePidPath)
if err == nil {
return joined, pid, nil
}
lastErr = err
}
} }
if lastErr != nil { if lastErr != nil {
return false, 0, lastErr return false, 0, lastErr
} }
return false, 0, errors.Wrapf(unix.ESRCH, "could not find any running process")
return joinUserAndMountNS(uint(pausePid), pausePidPath)
} }
// ReadMappingsProc parses and returns the ID mappings at the specified path. // ReadMappingsProc parses and returns the ID mappings at the specified path.