aboutsummaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
authorcdoern <cdoern@redhat.com>2022-01-13 10:43:24 -0500
committercdoern <cdoern@redhat.com>2022-01-13 14:03:51 -0500
commit6996830104afca5926daecc05d9154a0a9eb274d (patch)
tree006755309d1dfd265411390c08f1ddc9900cc76a /pkg
parente98058a3cf4f5ba4cd2d37dfdb2a0951b9aa9730 (diff)
downloadpodman-6996830104afca5926daecc05d9154a0a9eb274d.tar.gz
podman-6996830104afca5926daecc05d9154a0a9eb274d.tar.bz2
podman-6996830104afca5926daecc05d9154a0a9eb274d.zip
Prohibit --uid/gid map and --pod for container create/run
add a check in namespaceOptions() that ensures the user is not setting a new uid/gid map if entering or creating a pod that has an infra container resolves #12669 Signed-off-by: cdoern <cdoern@redhat.com>
Diffstat (limited to 'pkg')
-rw-r--r--pkg/specgen/generate/namespaces.go10
1 files changed, 8 insertions, 2 deletions
diff --git a/pkg/specgen/generate/namespaces.go b/pkg/specgen/generate/namespaces.go
index a2bc37e34..9d4c47cc3 100644
--- a/pkg/specgen/generate/namespaces.go
+++ b/pkg/specgen/generate/namespaces.go
@@ -193,8 +193,14 @@ func namespaceOptions(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.
// This wipes the UserNS settings that get set from the infra container
// when we are inheritting from the pod. So only apply this if the container
// is not being created in a pod.
- if s.IDMappings != nil && pod == nil {
- toReturn = append(toReturn, libpod.WithIDMappings(*s.IDMappings))
+ if s.IDMappings != nil {
+ if pod == nil {
+ toReturn = append(toReturn, libpod.WithIDMappings(*s.IDMappings))
+ } else {
+ if pod.HasInfraContainer() && (len(s.IDMappings.UIDMap) > 0 || len(s.IDMappings.GIDMap) > 0) {
+ return nil, errors.Wrapf(define.ErrInvalidArg, "cannot specify a new uid/gid map when entering a pod with an infra container")
+ }
+ }
}
if s.User != "" {
toReturn = append(toReturn, libpod.WithUser(s.User))