diff options
| author | cdoern <cdoern@redhat.com> | 2021-12-20 10:23:08 -0500 |
|---|---|---|
| committer | cdoern <cdoern@redhat.com> | 2021-12-21 17:19:41 -0500 |
| commit | 20ce6e5c6031bd4180514ec412760a294f8a83a2 (patch) | |
| tree | d725886615e4353e46cd30a73df188257ff7ade0 /pkg/specgen | |
| parent | f45070ee0e63ea26e475e618ff32a498096fa561 (diff) | |
| download | podman-20ce6e5c6031bd4180514ec412760a294f8a83a2.tar.gz podman-20ce6e5c6031bd4180514ec412760a294f8a83a2.tar.bz2 podman-20ce6e5c6031bd4180514ec412760a294f8a83a2.zip | |
Podman run --passwd
added support for a new flag --passwd which, when false prohibits podman from creating entries in
/etc/passwd and /etc/groups allowing users to modify those files in the container entrypoint
resolves #11805
Signed-off-by: cdoern <cdoern@redhat.com>
Diffstat (limited to 'pkg/specgen')
| -rw-r--r-- | pkg/specgen/generate/container_create.go | 3 | ||||
| -rw-r--r-- | pkg/specgen/specgen.go | 2 |
2 files changed, 5 insertions, 0 deletions
diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go index 331c9393a..7d8ef576a 100644 --- a/pkg/specgen/generate/container_create.go +++ b/pkg/specgen/generate/container_create.go @@ -482,5 +482,8 @@ func createContainerOptions(ctx context.Context, rt *libpod.Runtime, s *specgen. if s.PidFile != "" { options = append(options, libpod.WithPidFile(s.PidFile)) } + + options = append(options, libpod.WithSelectedPasswordManagement(s.Passwd)) + return options, nil } diff --git a/pkg/specgen/specgen.go b/pkg/specgen/specgen.go index e650c1966..5a1cc1144 100644 --- a/pkg/specgen/specgen.go +++ b/pkg/specgen/specgen.go @@ -201,6 +201,8 @@ type ContainerBasicConfig struct { // UnsetEnvAll unsets all default environment variables from the image or from buildin // Optional. UnsetEnvAll bool `json:"unsetenvall,omitempty"` + // Passwd is a container run option that determines if we are validating users/groups before running the container + Passwd *bool `json:"manage_password,omitempty"` } // ContainerStorageConfig contains information on the storage configuration of a |