From 720eb85ba55d8c825262e9b2e058ec8a8e0e4d9f Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 23 Aug 2018 23:02:04 +0200 Subject: rootless: fix exec We cannot re-exec into a new user namespace to gain privileges and access an existing as the new namespace is not the owner of the existing container. "unshare" is used to join the user namespace of the target container. The current implementation assumes that the main process of the container didn't create a new user namespace. Since in the setup phase we are not running with euid=0, we must skip the setup for containers/storage. Closes: https://github.com/containers/libpod/issues/1329 Signed-off-by: Giuseppe Scrivano Closes: #1331 Approved by: rhatdan --- cmd/podman/exec.go | 2 ++ cmd/podman/main.go | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) (limited to 'cmd') diff --git a/cmd/podman/exec.go b/cmd/podman/exec.go index 17a17f703..0cd6f98b7 100644 --- a/cmd/podman/exec.go +++ b/cmd/podman/exec.go @@ -6,6 +6,7 @@ import ( "github.com/containers/libpod/cmd/podman/libpodruntime" "github.com/containers/libpod/libpod" + "github.com/containers/libpod/pkg/rootless" "github.com/pkg/errors" "github.com/urfave/cli" ) @@ -66,6 +67,7 @@ func execCmd(c *cli.Context) error { if c.Bool("latest") { argStart = 0 } + rootless.SetSkipStorageSetup(true) cmd := args[argStart:] runtime, err := libpodruntime.GetRuntime(c) if err != nil { diff --git a/cmd/podman/main.go b/cmd/podman/main.go index 053049266..1734a2c9e 100644 --- a/cmd/podman/main.go +++ b/cmd/podman/main.go @@ -25,7 +25,7 @@ var ( exitCode = 125 ) -var cmdsNotRequiringRootless = map[string]bool{"help": true, "version": true} +var cmdsNotRequiringRootless = map[string]bool{"help": true, "version": true, "exec": true} func main() { debug := false -- cgit v1.2.3-54-g00ecf