diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2021-01-04 11:15:28 +0100 |
|---|---|---|
| committer | Giuseppe Scrivano <gscrivan@redhat.com> | 2021-01-04 14:19:58 +0100 |
| commit | 898f57c4c1c2abf14bc9fb000653b1e6634c10bf (patch) | |
| tree | dfa87d8eb08e58093ac22246a0862901970363ce /libpod | |
| parent | 23f25b8261cf2c0d83f8ce5b8251951a11a7e2c4 (diff) | |
| download | podman-898f57c4c1c2abf14bc9fb000653b1e6634c10bf.tar.gz podman-898f57c4c1c2abf14bc9fb000653b1e6634c10bf.tar.bz2 podman-898f57c4c1c2abf14bc9fb000653b1e6634c10bf.zip | |
systemd: make rundir always accessible
so that the PIDFile can be accessed also without being in the rootless
user namespace.
Closes: https://github.com/containers/podman/issues/8506
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/oci_conmon_linux.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go index 199b40097..47fa130f1 100644 --- a/libpod/oci_conmon_linux.go +++ b/libpod/oci_conmon_linux.go @@ -193,6 +193,11 @@ func hasCurrentUserMapped(ctr *Container) bool { // CreateContainer creates a container. func (r *ConmonOCIRuntime) CreateContainer(ctr *Container, restoreOptions *ContainerCheckpointOptions) error { + // always make the run dir accessible to the current user so that the PID files can be read without + // being in the rootless user namespace. + if err := makeAccessible(ctr.state.RunDir, 0, 0); err != nil { + return err + } if !hasCurrentUserMapped(ctr) { for _, i := range []string{ctr.state.RunDir, ctr.runtime.config.Engine.TmpDir, ctr.config.StaticDir, ctr.state.Mountpoint, ctr.runtime.config.Engine.VolumePath} { if err := makeAccessible(i, ctr.RootUID(), ctr.RootGID()); err != nil { |