diff options
Diffstat (limited to 'libpod/container_internal.go')
| -rw-r--r-- | libpod/container_internal.go | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/libpod/container_internal.go b/libpod/container_internal.go index f3247b1c0..c9454db8a 100644 --- a/libpod/container_internal.go +++ b/libpod/container_internal.go @@ -8,6 +8,7 @@ import ( "os" "path/filepath" "regexp" + "strconv" "strings" "syscall" "time" @@ -956,6 +957,29 @@ func (c *Container) generateSpec() (*spec.Spec, error) { g.SetProcessGID(gid) } + // Add addition groups if c.config.GroupAdd is not empty + if len(c.config.Groups) > 0 { + if !c.state.Mounted { + return nil, errors.Wrapf(ErrCtrStateInvalid, "container %s must be mounted in order to add additional groups", c.ID()) + } + for _, group := range c.config.Groups { + _, gid, err := chrootuser.GetUser(c.state.Mountpoint, strconv.Itoa(int(g.Spec().Process.User.UID))+":"+group) + if err != nil { + return nil, err + } + g.AddProcessAdditionalGid(uint32(gid)) + } + } + + // Look up and add groups the user belongs to + groups, err := chrootuser.GetAdditionalGroupsForUser(c.state.Mountpoint, uint64(g.Spec().Process.User.UID)) + if err != nil { + return nil, err + } + for _, gid := range groups { + g.AddProcessAdditionalGid(gid) + } + // Add shared namespaces from other containers if c.config.IPCNsCtr != "" { if err := c.addNamespaceContainer(&g, IPCNS, c.config.IPCNsCtr, spec.IPCNamespace); err != nil { |