From 2a976392632fb1eee80e215ba84ff1365ae816a9 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 24 Dec 2020 21:59:16 +0100 Subject: libpod: change function to accept ExecOptions Signed-off-by: Giuseppe Scrivano --- libpod/oci_conmon_exec_linux.go | 2 +- libpod/oci_conmon_linux.go | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) (limited to 'libpod') diff --git a/libpod/oci_conmon_exec_linux.go b/libpod/oci_conmon_exec_linux.go index f8e7020f7..4546acefb 100644 --- a/libpod/oci_conmon_exec_linux.go +++ b/libpod/oci_conmon_exec_linux.go @@ -387,7 +387,7 @@ func (r *ConmonOCIRuntime) startExec(c *Container, sessionID string, options *Ex finalEnv = append(finalEnv, fmt.Sprintf("%s=%s", k, v)) } - processFile, err := prepareProcessExec(c, options.Cmd, finalEnv, options.Terminal, options.Cwd, options.User, sessionID) + processFile, err := prepareProcessExec(c, options, finalEnv, sessionID) if err != nil { return nil, nil, err } diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go index c99086b33..10f97a8f9 100644 --- a/libpod/oci_conmon_linux.go +++ b/libpod/oci_conmon_linux.go @@ -1185,26 +1185,26 @@ func (r *ConmonOCIRuntime) createOCIContainer(ctr *Container, restoreOptions *Co // prepareProcessExec returns the path of the process.json used in runc exec -p // caller is responsible to close the returned *os.File if needed. -func prepareProcessExec(c *Container, cmd, env []string, tty bool, cwd, user, sessionID string) (*os.File, error) { +func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessionID string) (*os.File, error) { f, err := ioutil.TempFile(c.execBundlePath(sessionID), "exec-process-") if err != nil { return nil, err } pspec := c.config.Spec.Process pspec.SelinuxLabel = c.config.ProcessLabel - pspec.Args = cmd + pspec.Args = options.Cmd // We need to default this to false else it will inherit terminal as true // from the container. pspec.Terminal = false - if tty { + if options.Terminal { pspec.Terminal = true } if len(env) > 0 { pspec.Env = append(pspec.Env, env...) } - if cwd != "" { - pspec.Cwd = cwd + if options.Cwd != "" { + pspec.Cwd = options.Cwd } @@ -1212,6 +1212,7 @@ func prepareProcessExec(c *Container, cmd, env []string, tty bool, cwd, user, se var sgids []uint32 // if the user is empty, we should inherit the user that the container is currently running with + user := options.User if user == "" { user = c.config.User addGroups = c.config.Groups -- cgit v1.2.3-54-g00ecf From 2a39a6195aeb547c319e7de849f613e95c22c608 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Wed, 23 Dec 2020 21:53:55 +0100 Subject: exec: honor --privileged write the capabilities to the configuration passed to the OCI runtime. Signed-off-by: Giuseppe Scrivano --- libpod/oci_conmon_linux.go | 7 +++++++ test/e2e/exec_test.go | 15 +++++++++++++++ 2 files changed, 22 insertions(+) (limited to 'libpod') diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go index 10f97a8f9..199b40097 100644 --- a/libpod/oci_conmon_linux.go +++ b/libpod/oci_conmon_linux.go @@ -1193,6 +1193,13 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio pspec := c.config.Spec.Process pspec.SelinuxLabel = c.config.ProcessLabel pspec.Args = options.Cmd + for _, cap := range options.CapAdd { + pspec.Capabilities.Bounding = append(pspec.Capabilities.Bounding, cap) + pspec.Capabilities.Effective = append(pspec.Capabilities.Effective, cap) + pspec.Capabilities.Inheritable = append(pspec.Capabilities.Inheritable, cap) + pspec.Capabilities.Permitted = append(pspec.Capabilities.Permitted, cap) + pspec.Capabilities.Ambient = append(pspec.Capabilities.Ambient, cap) + } // We need to default this to false else it will inherit terminal as true // from the container. pspec.Terminal = false diff --git a/test/e2e/exec_test.go b/test/e2e/exec_test.go index f61f52589..18737105e 100644 --- a/test/e2e/exec_test.go +++ b/test/e2e/exec_test.go @@ -119,6 +119,21 @@ var _ = Describe("Podman exec", func() { Expect(session.ExitCode()).To(Equal(100)) }) + It("podman exec --privileged", func() { + hostCap := SystemExec("awk", []string{"/^CapEff/ { print $2 }", "/proc/self/status"}) + Expect(hostCap.ExitCode()).To(Equal(0)) + + setup := podmanTest.RunTopContainer("test-privileged") + setup.WaitWithDefaultTimeout() + Expect(setup.ExitCode()).To(Equal(0)) + + session := podmanTest.Podman([]string{"exec", "--privileged", "test-privileged", "sh", "-c", "grep ^CapEff /proc/self/status | cut -f 2"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + + containerCapMatchesHost(session.OutputToString(), hostCap.OutputToString()) + }) + It("podman exec terminal doesn't hang", func() { setup := podmanTest.Podman([]string{"run", "-dti", "--name", "test1", fedoraMinimal, "sleep", "+Inf"}) setup.WaitWithDefaultTimeout() -- cgit v1.2.3-54-g00ecf