summaryrefslogtreecommitdiff
path: root/libpod/oci_conmon_linux.go
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2021-01-04 11:15:28 +0100
committerGiuseppe Scrivano <gscrivan@redhat.com>2021-01-04 14:19:58 +0100
commit898f57c4c1c2abf14bc9fb000653b1e6634c10bf (patch)
treedfa87d8eb08e58093ac22246a0862901970363ce /libpod/oci_conmon_linux.go
parent23f25b8261cf2c0d83f8ce5b8251951a11a7e2c4 (diff)
downloadpodman-898f57c4c1c2abf14bc9fb000653b1e6634c10bf.tar.gz
podman-898f57c4c1c2abf14bc9fb000653b1e6634c10bf.tar.bz2
podman-898f57c4c1c2abf14bc9fb000653b1e6634c10bf.zip
systemd: make rundir always accessible
so that the PIDFile can be accessed also without being in the rootless user namespace. Closes: https://github.com/containers/podman/issues/8506 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'libpod/oci_conmon_linux.go')
-rw-r--r--libpod/oci_conmon_linux.go5
1 files changed, 5 insertions, 0 deletions
diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go
index 199b40097..47fa130f1 100644
--- a/libpod/oci_conmon_linux.go
+++ b/libpod/oci_conmon_linux.go
@@ -193,6 +193,11 @@ func hasCurrentUserMapped(ctr *Container) bool {
// CreateContainer creates a container.
func (r *ConmonOCIRuntime) CreateContainer(ctr *Container, restoreOptions *ContainerCheckpointOptions) error {
+ // always make the run dir accessible to the current user so that the PID files can be read without
+ // being in the rootless user namespace.
+ if err := makeAccessible(ctr.state.RunDir, 0, 0); err != nil {
+ return err
+ }
if !hasCurrentUserMapped(ctr) {
for _, i := range []string{ctr.state.RunDir, ctr.runtime.config.Engine.TmpDir, ctr.config.StaticDir, ctr.state.Mountpoint, ctr.runtime.config.Engine.VolumePath} {
if err := makeAccessible(i, ctr.RootUID(), ctr.RootGID()); err != nil {