summaryrefslogtreecommitdiff
path: root/cmd/podman
diff options
context:
space:
mode:
authorQi Wang <qiwan@redhat.com>2020-05-29 17:39:42 -0400
committerQi Wang <qiwan@redhat.com>2020-06-02 11:28:58 -0400
commit77e4b077b9d8989b1300689103a5489bd1ad9a8b (patch)
tree7f40976b06093fa7969a7cdcf19fb4365e45647c /cmd/podman
parentf559cec6c0d1694cca9530004aaba3c138f621e3 (diff)
downloadpodman-77e4b077b9d8989b1300689103a5489bd1ad9a8b.tar.gz
podman-77e4b077b9d8989b1300689103a5489bd1ad9a8b.tar.bz2
podman-77e4b077b9d8989b1300689103a5489bd1ad9a8b.zip
check --user range for rootless containers
Check --user range if it's a uid for rootless containers. Returns error if it is out of the range. From https://github.com/containers/libpod/issues/6431#issuecomment-636124686 Signed-off-by: Qi Wang <qiwan@redhat.com>
Diffstat (limited to 'cmd/podman')
-rw-r--r--cmd/podman/containers/run.go12
1 files changed, 12 insertions, 0 deletions
diff --git a/cmd/podman/containers/run.go b/cmd/podman/containers/run.go
index 890c6e827..8a02c63c0 100644
--- a/cmd/podman/containers/run.go
+++ b/cmd/podman/containers/run.go
@@ -3,6 +3,7 @@ package containers
import (
"fmt"
"os"
+ "strconv"
"strings"
"github.com/containers/libpod/cmd/podman/common"
@@ -10,7 +11,9 @@ import (
"github.com/containers/libpod/libpod/define"
"github.com/containers/libpod/pkg/domain/entities"
"github.com/containers/libpod/pkg/errorhandling"
+ "github.com/containers/libpod/pkg/rootless"
"github.com/containers/libpod/pkg/specgen"
+ "github.com/containers/libpod/pkg/util"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"github.com/spf13/cobra"
@@ -92,6 +95,15 @@ func run(cmd *cobra.Command, args []string) error {
return err
}
+ if rootless.IsRootless() && !registry.IsRemote() {
+ userspec := strings.SplitN(cliVals.User, ":", 2)[0]
+ if uid, err := strconv.ParseInt(userspec, 10, 32); err == nil {
+ if err := util.CheckRootlessUIDRange(int(uid)); err != nil {
+ return err
+ }
+ }
+ }
+
if af := cliVals.Authfile; len(af) > 0 {
if _, err := os.Stat(af); err != nil {
return errors.Wrapf(err, "error checking authfile path %s", af)