From bb4d269087d11623e15d1aa3c8cb197f29a601d1 Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Tue, 28 Jul 2020 09:18:21 -0400
Subject: Specifying --ipc=host --pid=host is broken

For some reason we were overwriting memory when handling both
--pid=host and --ipc=host.  Simplified the code to handle this
correctly, and add test to make sure it does not happen again.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
 cmd/podman/common/create_opts.go |  2 +-
 cmd/podman/common/specgen.go     | 64 ++++++++++++++++++++++++++--------------
 cmd/podman/containers/create.go  |  2 +-
 3 files changed, 44 insertions(+), 24 deletions(-)

(limited to 'cmd')

diff --git a/cmd/podman/common/create_opts.go b/cmd/podman/common/create_opts.go
index 3802c37b0..f9e4d7ca5 100644
--- a/cmd/podman/common/create_opts.go
+++ b/cmd/podman/common/create_opts.go
@@ -10,7 +10,7 @@ type ContainerCLIOpts struct {
 	BlkIOWeightDevice []string
 	CapAdd            []string
 	CapDrop           []string
-	CGroupsNS         string
+	CgroupNS          string
 	CGroupsMode       string
 	CGroupParent      string
 	CIDFile           string
diff --git a/cmd/podman/common/specgen.go b/cmd/podman/common/specgen.go
index 07c88efea..0b6897d3a 100644
--- a/cmd/podman/common/specgen.go
+++ b/cmd/podman/common/specgen.go
@@ -186,6 +186,46 @@ func getMemoryLimits(s *specgen.SpecGenerator, c *ContainerCLIOpts) (*specs.Linu
 	return memory, nil
 }
 
+func setNamespaces(s *specgen.SpecGenerator, c *ContainerCLIOpts) error {
+	var err error
+
+	if c.PID != "" {
+		s.PidNS, err = specgen.ParseNamespace(c.PID)
+		if err != nil {
+			return err
+		}
+	}
+	if c.IPC != "" {
+		s.IpcNS, err = specgen.ParseNamespace(c.IPC)
+		if err != nil {
+			return err
+		}
+	}
+	if c.UTS != "" {
+		s.UtsNS, err = specgen.ParseNamespace(c.UTS)
+		if err != nil {
+			return err
+		}
+	}
+	if c.CgroupNS != "" {
+		s.CgroupNS, err = specgen.ParseNamespace(c.CgroupNS)
+		if err != nil {
+			return err
+		}
+	}
+	// userns must be treated differently
+	if c.UserNS != "" {
+		s.UserNS, err = specgen.ParseUserNamespace(c.UserNS)
+		if err != nil {
+			return err
+		}
+	}
+	if c.Net != nil {
+		s.NetNS = c.Net.Network
+	}
+	return nil
+}
+
 func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string) error {
 	var (
 		err error
@@ -252,28 +292,8 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *ContainerCLIOpts, args []string
 	}
 	s.Expose = expose
 
-	for k, v := range map[string]*specgen.Namespace{
-		c.IPC:       &s.IpcNS,
-		c.PID:       &s.PidNS,
-		c.UTS:       &s.UtsNS,
-		c.CGroupsNS: &s.CgroupNS,
-	} {
-		if k != "" {
-			*v, err = specgen.ParseNamespace(k)
-			if err != nil {
-				return err
-			}
-		}
-	}
-	// userns must be treated differently
-	if c.UserNS != "" {
-		s.UserNS, err = specgen.ParseUserNamespace(c.UserNS)
-		if err != nil {
-			return err
-		}
-	}
-	if c.Net != nil {
-		s.NetNS = c.Net.Network
+	if err := setNamespaces(s, c); err != nil {
+		return err
 	}
 
 	if sig := c.StopSignal; len(sig) > 0 {
diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go
index dcbc52b56..dd77dc9d7 100644
--- a/cmd/podman/containers/create.go
+++ b/cmd/podman/containers/create.go
@@ -195,7 +195,7 @@ func createInit(c *cobra.Command) error {
 	cliVals.IPC = c.Flag("ipc").Value.String()
 	cliVals.UTS = c.Flag("uts").Value.String()
 	cliVals.PID = c.Flag("pid").Value.String()
-	cliVals.CGroupsNS = c.Flag("cgroupns").Value.String()
+	cliVals.CgroupNS = c.Flag("cgroupns").Value.String()
 	if c.Flag("entrypoint").Changed {
 		val := c.Flag("entrypoint").Value.String()
 		cliVals.Entrypoint = &val
-- 
cgit v1.2.3-54-g00ecf