diff options
| author | Matthew Heon <matthew.heon@pm.me> | 2020-02-27 16:08:29 -0500 |
|---|---|---|
| committer | Matthew Heon <matthew.heon@pm.me> | 2020-02-28 11:32:56 -0500 |
| commit | b41c864d569357a102ee2335a4947e59e5e2b08a (patch) | |
| tree | 8be00fe617420b47ec2960f540890baaa92c32ca /libpod/container_internal_linux.go | |
| parent | 25d29f959a16a881066727481cbbc0bd2d18c784 (diff) | |
| download | podman-b41c864d569357a102ee2335a4947e59e5e2b08a.tar.gz podman-b41c864d569357a102ee2335a4947e59e5e2b08a.tar.bz2 podman-b41c864d569357a102ee2335a4947e59e5e2b08a.zip | |
Ensure that exec sessions inherit supplemental groups
This corrects a regression from Podman 1.4.x where container exec
sessions inherited supplemental groups from the container, iff
the exec session did not specify a user.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Diffstat (limited to 'libpod/container_internal_linux.go')
| -rw-r--r-- | libpod/container_internal_linux.go | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index 739026264..63968918c 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -330,7 +330,10 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) { // Add addition groups if c.config.GroupAdd is not empty if len(c.config.Groups) > 0 { - gids, _ := lookup.GetContainerGroups(c.config.Groups, c.state.Mountpoint, nil) + gids, err := lookup.GetContainerGroups(c.config.Groups, c.state.Mountpoint, overrides) + if err != nil { + return nil, errors.Wrapf(err, "error looking up supplemental groups for container %s", c.ID()) + } for _, gid := range gids { g.AddProcessAdditionalGid(gid) } |