summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2022-06-14 10:49:14 +0200
committerGiuseppe Scrivano <gscrivan@redhat.com>2022-06-14 10:49:19 +0200
commitfcfcd4cdb1b19fe00f6769f33e6704a7f8700d40 (patch)
treecf5252f77a52bcd9662e322d69c72a33afdb84e9
parent576c739e5ff01c760b383a258c62ed3ca7e1c30c (diff)
downloadpodman-fcfcd4cdb1b19fe00f6769f33e6704a7f8700d40.tar.gz
podman-fcfcd4cdb1b19fe00f6769f33e6704a7f8700d40.tar.bz2
podman-fcfcd4cdb1b19fe00f6769f33e6704a7f8700d40.zip
container: do not create .containerenv with -v SRC:/run
if /run is on a volume do not create the file /run/.containerenv as it would leak outside of the container. Closes: https://github.com/containers/podman/issues/14577 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
-rw-r--r--libpod/container_internal_linux.go13
-rw-r--r--test/e2e/run_volume_test.go14
2 files changed, 26 insertions, 1 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index 41c0ac595..eafe3d75e 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -2249,8 +2249,19 @@ func (c *Container) makeBindMounts() error {
}
}
+ _, hasRunContainerenv := c.state.BindMounts["/run/.containerenv"]
+ if !hasRunContainerenv {
+ // check in the spec mounts
+ for _, m := range c.config.Spec.Mounts {
+ if m.Destination == "/run/.containerenv" || m.Destination == "/run" {
+ hasRunContainerenv = true
+ break
+ }
+ }
+ }
+
// Make .containerenv if it does not exist
- if _, ok := c.state.BindMounts["/run/.containerenv"]; !ok {
+ if !hasRunContainerenv {
containerenv := c.runtime.graphRootMountedFlag(c.config.Spec.Mounts)
isRootless := 0
if rootless.IsRootless() {
diff --git a/test/e2e/run_volume_test.go b/test/e2e/run_volume_test.go
index 1c0480407..f31e62e42 100644
--- a/test/e2e/run_volume_test.go
+++ b/test/e2e/run_volume_test.go
@@ -908,6 +908,20 @@ USER testuser`, fedoraMinimal)
Expect(session.OutputToString()).To(Equal(perms))
})
+ It("podman run with -v $SRC:/run does not create /run/.containerenv", func() {
+ mountSrc := filepath.Join(podmanTest.TempDir, "vol-test1")
+ err := os.MkdirAll(mountSrc, 0755)
+ Expect(err).To(BeNil())
+
+ session := podmanTest.Podman([]string{"run", "-v", mountSrc + ":/run", ALPINE, "true"})
+ session.WaitWithDefaultTimeout()
+ Expect(session).Should(Exit(0))
+
+ // the file should not have been created
+ _, err = os.Stat(filepath.Join(mountSrc, ".containerenv"))
+ Expect(err).To(Not(BeNil()))
+ })
+
It("podman volume with uid and gid works", func() {
volName := "testVol"
volCreate := podmanTest.Podman([]string{"volume", "create", "--opt", "o=uid=1000", volName})