diff options
Diffstat (limited to 'pkg')
| -rw-r--r-- | pkg/adapter/runtime.go | 8 | ||||
| -rw-r--r-- | pkg/adapter/runtime_remote.go | 12 | ||||
| -rw-r--r-- | pkg/secrets/secrets.go | 12 |
3 files changed, 28 insertions, 4 deletions
diff --git a/pkg/adapter/runtime.go b/pkg/adapter/runtime.go index 4f5b98dbb..8624981b1 100644 --- a/pkg/adapter/runtime.go +++ b/pkg/adapter/runtime.go @@ -333,3 +333,11 @@ func (r *LocalRuntime) LoadImage(ctx context.Context, name string, cli *cliconfi } return r.Runtime.LoadImage(ctx, name, cli.Input, writer, cli.SignaturePolicy) } + +// IsImageNotFound checks if the error indicates that no image was found. +func IsImageNotFound(err error) bool { + if errors.Cause(err) == image.ErrNoSuchImage { + return true + } + return false +} diff --git a/pkg/adapter/runtime_remote.go b/pkg/adapter/runtime_remote.go index ca2fad852..29b43e9b0 100644 --- a/pkg/adapter/runtime_remote.go +++ b/pkg/adapter/runtime_remote.go @@ -796,3 +796,15 @@ func (r *LocalRuntime) LoadImage(ctx context.Context, name string, cli *cliconfi } return names, nil } + +// IsImageNotFound checks if the error indicates that no image was found. +func IsImageNotFound(err error) bool { + if errors.Cause(err) == image.ErrNoSuchImage { + return true + } + switch err.(type) { + case *iopodman.ImageNotFound: + return true + } + return false +} diff --git a/pkg/secrets/secrets.go b/pkg/secrets/secrets.go index 242953609..3b64f8952 100644 --- a/pkg/secrets/secrets.go +++ b/pkg/secrets/secrets.go @@ -8,6 +8,7 @@ import ( "strings" "github.com/containers/libpod/pkg/rootless" + "github.com/containers/storage/pkg/idtools" rspec "github.com/opencontainers/runtime-spec/specs-go" "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" @@ -176,7 +177,7 @@ func SecretMountsWithUIDGID(mountLabel, containerWorkingDir, mountFile, mountPre // Add FIPS mode secret if /etc/system-fips exists on the host _, err := os.Stat("/etc/system-fips") if err == nil { - if err := addFIPSModeSecret(&secretMounts, containerWorkingDir); err != nil { + if err := addFIPSModeSecret(&secretMounts, containerWorkingDir, mountPrefix, mountLabel, uid, gid); err != nil { logrus.Errorf("error adding FIPS mode secret to container: %v", err) } } else if os.IsNotExist(err) { @@ -264,13 +265,16 @@ func addSecretsFromMountsFile(filePath, mountLabel, containerWorkingDir, mountPr // root filesystem if /etc/system-fips exists on hosts. // This enables the container to be FIPS compliant and run openssl in // FIPS mode as the host is also in FIPS mode. -func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir string) error { +func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir, mountPrefix, mountLabel string, uid, gid int) error { secretsDir := "/run/secrets" ctrDirOnHost := filepath.Join(containerWorkingDir, secretsDir) if _, err := os.Stat(ctrDirOnHost); os.IsNotExist(err) { - if err = os.MkdirAll(ctrDirOnHost, 0755); err != nil { + if err = idtools.MkdirAllAs(ctrDirOnHost, 0755, uid, gid); err != nil { return errors.Wrapf(err, "making container directory on host failed") } + if err = label.Relabel(ctrDirOnHost, mountLabel, false); err != nil { + return errors.Wrap(err, "error applying correct labels") + } } fipsFile := filepath.Join(ctrDirOnHost, "system-fips") // In the event of restart, it is possible for the FIPS mode file to already exist @@ -284,7 +288,7 @@ func addFIPSModeSecret(mounts *[]rspec.Mount, containerWorkingDir string) error if !mountExists(*mounts, secretsDir) { m := rspec.Mount{ - Source: ctrDirOnHost, + Source: filepath.Join(mountPrefix, secretsDir), Destination: secretsDir, Type: "bind", Options: []string{"bind", "rprivate"}, |