From 3875040f134de0aef01d4f360fe563f52ae7b441 Mon Sep 17 00:00:00 2001 From: Matthew Heon Date: Mon, 31 Aug 2020 14:06:49 -0400 Subject: Ensure rootless containers without a passwd can start We want to modify /etc/passwd to add an entry for the user in question, but at the same time we don't want to require the container provide a /etc/passwd (a container with a single, statically linked binary and nothing else is perfectly fine and should be allowed, for example). We could create the passwd file if it does not exist, but if the container doesn't provide one, it's probably better not to make one at all. Gate changes to /etc/passwd behind a stat() of the file in the container returning cleanly. Fixes #7515 Signed-off-by: Matthew Heon --- libpod/container_internal_linux.go | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'libpod/container_internal_linux.go') diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index 31dbee572..c61c1a325 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -1584,6 +1584,17 @@ func (c *Container) generatePasswd() (string, error) { if _, err := os.Stat(passwdPath); err == nil { return passwdPath, nil } + // Check if container has a /etc/passwd - if it doesn't do nothing. + passwdPath, err := securejoin.SecureJoin(c.state.Mountpoint, "/etc/passwd") + if err != nil { + return "", errors.Wrapf(err, "error creating path to container %s /etc/passwd", c.ID()) + } + if _, err := os.Stat(passwdPath); err != nil { + if os.IsNotExist(err) { + return "", nil + } + return "", errors.Wrapf(err, "unable to access container %s /etc/passwd", c.ID()) + } pwd := "" if c.config.User != "" { entry, err := c.generateUserPasswdEntry() -- cgit v1.2.3-54-g00ecf