diff options
| author | Matthew Heon <matthew.heon@pm.me> | 2021-04-05 15:49:35 -0400 |
|---|---|---|
| committer | Matthew Heon <mheon@redhat.com> | 2021-04-16 13:05:11 -0400 |
| commit | 0cbd3225909d982a7dbd5fbc8c593dc1315abb8b (patch) | |
| tree | f3fa2758bfaa803f3945772bada1c915bb7a43b6 /pkg/specgen/podspecgen.go | |
| parent | 1df7f8e969556bd650d9daad2e4dfe0895ec433f (diff) | |
| download | podman-0cbd3225909d982a7dbd5fbc8c593dc1315abb8b.tar.gz podman-0cbd3225909d982a7dbd5fbc8c593dc1315abb8b.tar.bz2 podman-0cbd3225909d982a7dbd5fbc8c593dc1315abb8b.zip | |
Ensure that `--userns=keep-id` sets user in config
One of the side-effects of the `--userns=keep-id` command is
switching the default user of the container to the UID of the
user running Podman (though this can still be overridden by the
`--user` flag). However, it did this by setting the UID and GID
in the OCI spec, and not by informing Libpod of its intention to
switch users via the `WithUser()` option. Because of this, a lot
of the code that should have triggered when the container ran
with a non-root user was not triggering. In the case of the issue
that this fixed, the code to remove capabilities from non-root
users was not triggering. Adjust the keep-id code to properly
inform Libpod of our intention to use a non-root user to fix
this.
Also, fix an annoying race around short-running exec sessions
where Podman would always print a warning that the exec session
had already stopped.
Fixes #9919
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Diffstat (limited to 'pkg/specgen/podspecgen.go')
0 files changed, 0 insertions, 0 deletions