diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2018-08-23 23:02:04 +0200 |
|---|---|---|
| committer | Atomic Bot <atomic-devel@projectatomic.io> | 2018-08-26 07:22:42 +0000 |
| commit | 720eb85ba55d8c825262e9b2e058ec8a8e0e4d9f (patch) | |
| tree | 73ef0abad027bc6bffe97d75b6936b8c7562cca8 /cmd | |
| parent | 1ac4dbb50861d502cb819c63335848a60ffa7dec (diff) | |
| download | podman-720eb85ba55d8c825262e9b2e058ec8a8e0e4d9f.tar.gz podman-720eb85ba55d8c825262e9b2e058ec8a8e0e4d9f.tar.bz2 podman-720eb85ba55d8c825262e9b2e058ec8a8e0e4d9f.zip | |
rootless: fix exec
We cannot re-exec into a new user namespace to gain privileges and
access an existing as the new namespace is not the owner of the
existing container.
"unshare" is used to join the user namespace of the target container.
The current implementation assumes that the main process of the
container didn't create a new user namespace.
Since in the setup phase we are not running with euid=0, we must skip
the setup for containers/storage.
Closes: https://github.com/containers/libpod/issues/1329
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Closes: #1331
Approved by: rhatdan
Diffstat (limited to 'cmd')
| -rw-r--r-- | cmd/podman/exec.go | 2 | ||||
| -rw-r--r-- | cmd/podman/main.go | 2 |
2 files changed, 3 insertions, 1 deletions
diff --git a/cmd/podman/exec.go b/cmd/podman/exec.go index 17a17f703..0cd6f98b7 100644 --- a/cmd/podman/exec.go +++ b/cmd/podman/exec.go @@ -6,6 +6,7 @@ import ( "github.com/containers/libpod/cmd/podman/libpodruntime" "github.com/containers/libpod/libpod" + "github.com/containers/libpod/pkg/rootless" "github.com/pkg/errors" "github.com/urfave/cli" ) @@ -66,6 +67,7 @@ func execCmd(c *cli.Context) error { if c.Bool("latest") { argStart = 0 } + rootless.SetSkipStorageSetup(true) cmd := args[argStart:] runtime, err := libpodruntime.GetRuntime(c) if err != nil { diff --git a/cmd/podman/main.go b/cmd/podman/main.go index 053049266..1734a2c9e 100644 --- a/cmd/podman/main.go +++ b/cmd/podman/main.go @@ -25,7 +25,7 @@ var ( exitCode = 125 ) -var cmdsNotRequiringRootless = map[string]bool{"help": true, "version": true} +var cmdsNotRequiringRootless = map[string]bool{"help": true, "version": true, "exec": true} func main() { debug := false |