summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2020-10-01 10:52:58 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2020-10-01 10:54:28 -0400
commitbaede7cd2776b1f722dcbb65cff6228eeab5db44 (patch)
tree0024bf9adf84af49fda19e0d4cc20c0a7b3be318
parent3948cb76e266e930e0f1762b7145f72d65baf39f (diff)
downloadpodman-baede7cd2776b1f722dcbb65cff6228eeab5db44.tar.gz
podman-baede7cd2776b1f722dcbb65cff6228eeab5db44.tar.bz2
podman-baede7cd2776b1f722dcbb65cff6228eeab5db44.zip
Add additionalGIDs from users in rootless mode
There is a risk here, that if the GID does not exists within the User Namespace the container will fail to start. This is only likely to happen in HPC Envioronments, and I think we should add a field to disable it for this environment, Added a FIXME for this issue. We currently have this problem with running a rootfull container within a user namespace, it will fail if the GID is not available. I looked at potentially checking the usernamespace that you are assigned to, but I believe this will be very difficult to code up and to figure out. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
-rw-r--r--libpod/container_internal_linux.go3
1 files changed, 2 insertions, 1 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index dde7cafb1..eba732d2a 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -415,8 +415,9 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
}
// Look up and add groups the user belongs to, if a group wasn't directly specified
- if !rootless.IsRootless() && !strings.Contains(c.config.User, ":") {
+ if !strings.Contains(c.config.User, ":") {
for _, gid := range execUser.Sgids {
+ // FIXME: We need to add a flag to containers.conf to not add these for HPC Users.
g.AddProcessAdditionalGid(uint32(gid))
}
}