diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2022-08-08 11:09:53 +0200 |
|---|---|---|
| committer | Matthew Heon <mheon@redhat.com> | 2022-08-10 16:46:05 -0400 |
| commit | fa1085ed01e2b901bfd3963ea4e1952a9d27a694 (patch) | |
| tree | 6cf52a085515ae57082222210553f6adb733a3a6 /cmd/podman | |
| parent | 91a1f3022b7bcc84e8587d104c86f3e61979467b (diff) | |
| download | podman-fa1085ed01e2b901bfd3963ea4e1952a9d27a694.tar.gz podman-fa1085ed01e2b901bfd3963ea4e1952a9d27a694.tar.bz2 podman-fa1085ed01e2b901bfd3963ea4e1952a9d27a694.zip | |
cmd: refuse --userns if a mapping is specified
if an explicit mapping is specified, do not accept `--userns` since it
overriden to "private".
Closes: https://github.com/containers/podman/issues/15233
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'cmd/podman')
| -rw-r--r-- | cmd/podman/containers/create.go | 16 |
1 files changed, 7 insertions, 9 deletions
diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go index 7d0f4d9ae..455127fd7 100644 --- a/cmd/podman/containers/create.go +++ b/cmd/podman/containers/create.go @@ -192,16 +192,14 @@ func replaceContainer(name string) error { } func CreateInit(c *cobra.Command, vals entities.ContainerCreateOptions, isInfra bool) (entities.ContainerCreateOptions, error) { - vals.UserNS = c.Flag("userns").Value.String() - // if user did not modify --userns flag and did turn on - // uid/gid mappings, set userns flag to "private" - if !c.Flag("userns").Changed && vals.UserNS == "host" { - if len(vals.UIDMap) > 0 || - len(vals.GIDMap) > 0 || - vals.SubUIDName != "" || - vals.SubGIDName != "" { - vals.UserNS = "private" + if len(vals.UIDMap) > 0 || len(vals.GIDMap) > 0 || vals.SubUIDName != "" || vals.SubGIDName != "" { + if c.Flag("userns").Changed { + return vals, errors.New("--userns and --uidmap/--gidmap/--subuidname/--subgidname are mutually exclusive") } + // force userns flag to "private" + vals.UserNS = "private" + } else { + vals.UserNS = c.Flag("userns").Value.String() } if c.Flag("kernel-memory") != nil && c.Flag("kernel-memory").Changed { logrus.Warnf("The --kernel-memory flag is no longer supported. This flag is a noop.") |