summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2020-04-22 12:38:19 +0200
committerGiuseppe Scrivano <gscrivan@redhat.com>2020-04-23 18:05:03 +0200
commit48530acbd9a622cf88dbbb10cbc8e91575c476e5 (patch)
tree87ba5a727ec653d514e18e2686aa58453e20f70b /pkg
parent2fd6a84c09c4361c16f0bfe086dd4a190c5635b3 (diff)
downloadpodman-48530acbd9a622cf88dbbb10cbc8e91575c476e5.tar.gz
podman-48530acbd9a622cf88dbbb10cbc8e91575c476e5.tar.bz2
podman-48530acbd9a622cf88dbbb10cbc8e91575c476e5.zip
podman: handle namespaces specified on the CLI
and handle differently the user namespace as it supports additional options. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'pkg')
-rw-r--r--pkg/specgen/container_validate.go2
-rw-r--r--pkg/specgen/generate/namespaces.go3
-rw-r--r--pkg/specgen/namespaces.go39
3 files changed, 41 insertions, 3 deletions
diff --git a/pkg/specgen/container_validate.go b/pkg/specgen/container_validate.go
index 219abfd9b..56c1a7ea9 100644
--- a/pkg/specgen/container_validate.go
+++ b/pkg/specgen/container_validate.go
@@ -129,7 +129,7 @@ func (s *SpecGenerator) Validate() error {
if err := s.CgroupNS.validate(); err != nil {
return err
}
- if err := s.UserNS.validate(); err != nil {
+ if err := validateUserNS(&s.UserNS); err != nil {
return err
}
diff --git a/pkg/specgen/generate/namespaces.go b/pkg/specgen/generate/namespaces.go
index 4ec1e859c..2aaeb9513 100644
--- a/pkg/specgen/generate/namespaces.go
+++ b/pkg/specgen/generate/namespaces.go
@@ -58,8 +58,7 @@ func GetDefaultNamespaceMode(nsType string, cfg *config.Config, pod *libpod.Pod)
case "uts":
return specgen.ParseNamespace(cfg.Containers.UTSNS)
case "user":
- // TODO: This may not work for --userns=auto
- return specgen.ParseNamespace(cfg.Containers.UserNS)
+ return specgen.ParseUserNamespace(cfg.Containers.UserNS)
case "net":
ns, _, err := specgen.ParseNetworkNamespace(cfg.Containers.NetNS)
return ns, err
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 4f35b31bf..fffbd6d9e 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -33,6 +33,11 @@ const (
// Slirp indicates that a slirp4netns network stack should
// be used
Slirp NamespaceMode = "slirp4netns"
+ // KeepId indicates a user namespace to keep the owner uid inside
+ // of the namespace itself
+ KeepID NamespaceMode = "keep-id"
+ // KeepId indicates to automatically create a user namespace
+ Auto NamespaceMode = "auto"
)
// Namespace describes the namespace
@@ -71,6 +76,16 @@ func (n *Namespace) IsPod() bool {
func (n *Namespace) IsPrivate() bool {
return n.NSMode == Private
}
+func validateUserNS(n *Namespace) error {
+ if n == nil {
+ return nil
+ }
+ switch n.NSMode {
+ case Auto, KeepID:
+ return nil
+ }
+ return n.validate()
+}
func validateNetNS(n *Namespace) error {
if n == nil {
@@ -158,6 +173,30 @@ func ParseNamespace(ns string) (Namespace, error) {
return toReturn, nil
}
+// ParseUserNamespace parses a user namespace specification in string
+// form.
+func ParseUserNamespace(ns string) (Namespace, error) {
+ toReturn := Namespace{}
+ switch {
+ case ns == "auto":
+ toReturn.NSMode = Auto
+ return toReturn, nil
+ case strings.HasPrefix(ns, "auto:"):
+ split := strings.SplitN(ns, ":", 2)
+ if len(split) != 2 {
+ return toReturn, errors.Errorf("invalid setting for auto: mode")
+ }
+ toReturn.NSMode = KeepID
+ toReturn.Value = split[1]
+ return toReturn, nil
+ case ns == "keep-id":
+ toReturn.NSMode = KeepID
+ toReturn.NSMode = FromContainer
+ return toReturn, nil
+ }
+ return ParseNamespace(ns)
+}
+
// ParseNetworkNamespace parses a network namespace specification in string
// form.
// Returns a namespace and (optionally) a list of CNI networks to join.