diff options
| author | Nalin Dahyabhai <nalin@redhat.com> | 2021-09-07 14:56:09 -0400 |
|---|---|---|
| committer | Nalin Dahyabhai <nalin@redhat.com> | 2021-09-07 15:29:33 -0400 |
| commit | 748c2700b4d839a43be6061ad3bedc3e2f08ab3a (patch) | |
| tree | 87a465d838ae70e0a36fdefd664b5f5dba2f0327 /pkg/bindings | |
| parent | 536f23c0b78dd8feafee4e40b743988dbb03bfa2 (diff) | |
| download | podman-748c2700b4d839a43be6061ad3bedc3e2f08ab3a.tar.gz podman-748c2700b4d839a43be6061ad3bedc3e2f08ab3a.tar.bz2 podman-748c2700b4d839a43be6061ad3bedc3e2f08ab3a.zip | |
pkg/bindings/images.nTar(): set ownership of build context to 0:0
When attempting to run remote builds, users with UID/GID values that
were high enough that they wouldn't be mapped into their default user
namespace configurations would see their builds fail when the server
attempted to extract the build contexts that they supplied, and failed
to set ownership of the build context content to the UID/GID that were
originally assigned to them.
When archiving the build context at the client, set ownership of
everything to 0:0, which we know is always mapped. Both ADD and COPY
require that we set the ownership of newly-added content to 0:0 (unless
the --chown flag is used), so throwing away the original ownership
information doesn't hurt, anyway. As usual, tarballs that we extract
as part of ADD aren't going to be affected.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Diffstat (limited to 'pkg/bindings')
| -rw-r--r-- | pkg/bindings/images/build.go | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/pkg/bindings/images/build.go b/pkg/bindings/images/build.go index 39e0fc5df..3beafa585 100644 --- a/pkg/bindings/images/build.go +++ b/pkg/bindings/images/build.go @@ -501,6 +501,7 @@ func nTar(excludes []string, sources ...string) (io.ReadCloser, error) { if err != nil { return err } + hdr.Uid, hdr.Gid = 0, 0 orig, ok := seen[di] if ok { hdr.Typeflag = tar.TypeLink @@ -532,6 +533,7 @@ func nTar(excludes []string, sources ...string) (io.ReadCloser, error) { return lerr } hdr.Name = name + hdr.Uid, hdr.Gid = 0, 0 if lerr := tw.WriteHeader(hdr); lerr != nil { return lerr } @@ -545,6 +547,7 @@ func nTar(excludes []string, sources ...string) (io.ReadCloser, error) { return lerr } hdr.Name = name + hdr.Uid, hdr.Gid = 0, 0 if lerr := tw.WriteHeader(hdr); lerr != nil { return lerr } |