summaryrefslogtreecommitdiff
path: root/libpod/container_internal.go
diff options
context:
space:
mode:
authorumohnani8 <umohnani@redhat.com>2018-04-03 13:37:25 -0400
committerAtomic Bot <atomic-devel@projectatomic.io>2018-04-06 00:09:46 +0000
commit998fd2ece0480e581e013124d0969a1af6305110 (patch)
tree84f3ae049fb1246a2f31c5eb5f55b40e6a17fc81 /libpod/container_internal.go
parentc3e2b00333d42dc87a3385939715813006cc8af1 (diff)
downloadpodman-998fd2ece0480e581e013124d0969a1af6305110.tar.gz
podman-998fd2ece0480e581e013124d0969a1af6305110.tar.bz2
podman-998fd2ece0480e581e013124d0969a1af6305110.zip
Functionality changes to the following flags
--group-add --blkio-weight-device --device-read-bps --device-write-bps --device-read-iops --device-write-iops --group-add now supports group names as well as the gid associated with them. All the --device flags work now with moderate changes to the code to support both bps and iops. Added tests for all the flags. Signed-off-by: umohnani8 <umohnani@redhat.com> Closes: #590 Approved by: mheon
Diffstat (limited to 'libpod/container_internal.go')
-rw-r--r--libpod/container_internal.go24
1 files changed, 24 insertions, 0 deletions
diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index f3247b1c0..c9454db8a 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -8,6 +8,7 @@ import (
"os"
"path/filepath"
"regexp"
+ "strconv"
"strings"
"syscall"
"time"
@@ -956,6 +957,29 @@ func (c *Container) generateSpec() (*spec.Spec, error) {
g.SetProcessGID(gid)
}
+ // Add addition groups if c.config.GroupAdd is not empty
+ if len(c.config.Groups) > 0 {
+ if !c.state.Mounted {
+ return nil, errors.Wrapf(ErrCtrStateInvalid, "container %s must be mounted in order to add additional groups", c.ID())
+ }
+ for _, group := range c.config.Groups {
+ _, gid, err := chrootuser.GetUser(c.state.Mountpoint, strconv.Itoa(int(g.Spec().Process.User.UID))+":"+group)
+ if err != nil {
+ return nil, err
+ }
+ g.AddProcessAdditionalGid(uint32(gid))
+ }
+ }
+
+ // Look up and add groups the user belongs to
+ groups, err := chrootuser.GetAdditionalGroupsForUser(c.state.Mountpoint, uint64(g.Spec().Process.User.UID))
+ if err != nil {
+ return nil, err
+ }
+ for _, gid := range groups {
+ g.AddProcessAdditionalGid(gid)
+ }
+
// Add shared namespaces from other containers
if c.config.IPCNsCtr != "" {
if err := c.addNamespaceContainer(&g, IPCNS, c.config.IPCNsCtr, spec.IPCNamespace); err != nil {