summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cmd/podman/create.go4
-rw-r--r--cmd/podman/pause.go2
-rw-r--r--cmd/podman/run.go2
-rw-r--r--cmd/podman/stats.go2
-rw-r--r--cmd/podman/unpause.go2
-rw-r--r--libpod/oci_linux.go2
-rw-r--r--libpod/runtime.go2
-rw-r--r--pkg/rootless/rootless_linux.c4
-rw-r--r--pkg/rootless/rootless_linux.go8
-rw-r--r--test/e2e/libpod_suite_test.go9
10 files changed, 21 insertions, 16 deletions
diff --git a/cmd/podman/create.go b/cmd/podman/create.go
index 04f3cd9e6..20d976c0b 100644
--- a/cmd/podman/create.go
+++ b/cmd/podman/create.go
@@ -99,7 +99,7 @@ func createCmd(c *cli.Context) error {
storageOpts.UIDMap = mappings.UIDMap
storageOpts.GIDMap = mappings.GIDMap
- if os.Getuid() != 0 {
+ if os.Geteuid() != 0 {
rootless.SetSkipStorageSetup(true)
}
@@ -778,7 +778,7 @@ func parseCreateOpts(ctx context.Context, c *cli.Context, runtime *libpod.Runtim
}
func joinOrCreateRootlessUserNamespace(createConfig *cc.CreateConfig, runtime *libpod.Runtime) (bool, int, error) {
- if os.Getuid() == 0 {
+ if os.Geteuid() == 0 {
return false, 0, nil
}
diff --git a/cmd/podman/pause.go b/cmd/podman/pause.go
index e6224dcd2..203fa6070 100644
--- a/cmd/podman/pause.go
+++ b/cmd/podman/pause.go
@@ -26,7 +26,7 @@ var (
)
func pauseCmd(c *cli.Context) error {
- if os.Getuid() != 0 {
+ if os.Geteuid() != 0 {
return errors.New("pause is not supported for rootless containers")
}
diff --git a/cmd/podman/run.go b/cmd/podman/run.go
index d8a8a48d5..3445daef5 100644
--- a/cmd/podman/run.go
+++ b/cmd/podman/run.go
@@ -74,7 +74,7 @@ func runCmd(c *cli.Context) error {
storageOpts.UIDMap = mappings.UIDMap
storageOpts.GIDMap = mappings.GIDMap
- if os.Getuid() != 0 {
+ if os.Geteuid() != 0 {
rootless.SetSkipStorageSetup(true)
}
diff --git a/cmd/podman/stats.go b/cmd/podman/stats.go
index 181f5376c..0e1d2a9c6 100644
--- a/cmd/podman/stats.go
+++ b/cmd/podman/stats.go
@@ -64,7 +64,7 @@ func statsCmd(c *cli.Context) error {
return err
}
- if os.Getuid() != 0 {
+ if os.Geteuid() != 0 {
return errors.New("stats is not supported for rootless containers")
}
diff --git a/cmd/podman/unpause.go b/cmd/podman/unpause.go
index d4e2605cb..a792aaf6d 100644
--- a/cmd/podman/unpause.go
+++ b/cmd/podman/unpause.go
@@ -26,7 +26,7 @@ var (
)
func unpauseCmd(c *cli.Context) error {
- if os.Getuid() != 0 {
+ if os.Geteuid() != 0 {
return errors.New("unpause is not supported for rootless containers")
}
diff --git a/libpod/oci_linux.go b/libpod/oci_linux.go
index 335a7eec3..210ba57d1 100644
--- a/libpod/oci_linux.go
+++ b/libpod/oci_linux.go
@@ -20,7 +20,7 @@ import (
)
func (r *OCIRuntime) moveConmonToCgroup(ctr *Container, cgroupParent string, cmd *exec.Cmd) error {
- if os.Getuid() == 0 {
+ if os.Geteuid() == 0 {
if r.cgroupManager == SystemdCgroupsManager {
unitName := createUnitName("libpod-conmon", ctr.ID())
diff --git a/libpod/runtime.go b/libpod/runtime.go
index da5d9fa70..c405eb773 100644
--- a/libpod/runtime.go
+++ b/libpod/runtime.go
@@ -561,7 +561,7 @@ func makeRuntime(runtime *Runtime) (err error) {
// empty state only creates a single file
// As such, it's not really a performance concern
if os.IsNotExist(err) {
- if os.Getuid() != 0 {
+ if os.Geteuid() != 0 {
aliveLock.Unlock()
locked = false
if err2 := runtime.refreshRootless(); err2 != nil {
diff --git a/pkg/rootless/rootless_linux.c b/pkg/rootless/rootless_linux.c
index e894328ce..d78d95453 100644
--- a/pkg/rootless/rootless_linux.c
+++ b/pkg/rootless/rootless_linux.c
@@ -107,6 +107,10 @@ reexec_userns_join (int userns)
_exit (EXIT_FAILURE);
close (userns);
+ if (setresgid (0, 0, 0) < 0 ||
+ setresuid (0, 0, 0) < 0)
+ _exit (EXIT_FAILURE);
+
execvp (argv[0], argv);
_exit (EXIT_FAILURE);
diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go
index 9a8534922..92020cf1c 100644
--- a/pkg/rootless/rootless_linux.go
+++ b/pkg/rootless/rootless_linux.go
@@ -34,7 +34,7 @@ func runInUser() error {
// IsRootless tells us if we are running in rootless mode
func IsRootless() bool {
- return os.Getuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != ""
+ return os.Geteuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != ""
}
var (
@@ -88,7 +88,7 @@ func tryMappingTool(tool string, pid int, hostID int, mappings []idtools.IDMap)
// JoinNS re-exec podman in a new userNS and join the user namespace of the specified
// PID.
func JoinNS(pid uint) (bool, int, error) {
- if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
+ if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
return false, -1, nil
}
@@ -116,7 +116,7 @@ func JoinNS(pid uint) (bool, int, error) {
// If podman was re-executed the caller needs to propagate the error code returned by the child
// process.
func BecomeRootInUserNS() (bool, int, error) {
- if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
+ if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
if os.Getenv("_LIBPOD_USERNS_CONFIGURED") == "init" {
return false, 0, runInUser()
}
@@ -142,7 +142,7 @@ func BecomeRootInUserNS() (bool, int, error) {
var uids, gids []idtools.IDMap
username := os.Getenv("USER")
if username == "" {
- user, err := user.LookupId(fmt.Sprintf("%d", os.Geteuid()))
+ user, err := user.LookupId(fmt.Sprintf("%d", os.Getuid()))
if err != nil && os.Getenv("PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS") == "" {
return false, 0, errors.Wrapf(err, "could not find user by UID nor USER env was set")
}
diff --git a/test/e2e/libpod_suite_test.go b/test/e2e/libpod_suite_test.go
index 8c9183450..dcc5fd913 100644
--- a/test/e2e/libpod_suite_test.go
+++ b/test/e2e/libpod_suite_test.go
@@ -10,7 +10,6 @@ import (
"os/exec"
"path/filepath"
"strings"
- "syscall"
"testing"
"time"
@@ -190,11 +189,13 @@ func (p *PodmanTest) PodmanAsUser(args []string, uid, gid uint32, env []string)
} else {
fmt.Printf("Running: (env: %v) %s %s\n", env, p.PodmanBinary, strings.Join(podmanOptions, " "))
}
- command := exec.Command(p.PodmanBinary, podmanOptions...)
+ var command *exec.Cmd
if uid != 0 || gid != 0 {
- command.SysProcAttr = &syscall.SysProcAttr{}
- command.SysProcAttr.Credential = &syscall.Credential{Uid: uid, Gid: gid}
+ nsEnterOpts := append([]string{"--userspec", fmt.Sprintf("%d:%d", uid, gid), "/", p.PodmanBinary}, podmanOptions...)
+ command = exec.Command("chroot", nsEnterOpts...)
+ } else {
+ command = exec.Command(p.PodmanBinary, podmanOptions...)
}
if env != nil {
command.Env = env
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-15 13:51:13 +0000