From 146c8c0c62dc30a08eb5ff302217d91dfd29d158 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Fri, 21 Jan 2022 17:53:03 -0800 Subject: [PATCH] libct: fixStdioPermissions: ignore EROFS In case of a read-only /dev, it's better to move on and let whatever is run in a container to handle any possible errors. This solves runc exec for a user with read-only /dev. Signed-off-by: Kir Kolyshkin --- libcontainer/init_linux.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/libcontainer/init_linux.go b/libcontainer/init_linux.go index 2d7af1d4d..1e5c394c3 100644 --- a/libcontainer/init_linux.go +++ b/libcontainer/init_linux.go @@ -426,11 +426,12 @@ func fixStdioPermissions(u *user.ExecUser) error { // If we've hit an EINVAL then s.Gid isn't mapped in the user // namespace. If we've hit an EPERM then the inode's current owner // is not mapped in our user namespace (in particular, - // privileged_wrt_inode_uidgid() has failed). In either case, we - // are in a configuration where it's better for us to just not - // touch the stdio rather than bail at this point. + // privileged_wrt_inode_uidgid() has failed). Read-only + // /dev can result in EROFS error. In any case, it's + // better for us to just not touch the stdio rather + // than bail at this point. - if errors.Is(err, unix.EINVAL) || errors.Is(err, unix.EPERM) { + if errors.Is(err, unix.EINVAL) || errors.Is(err, unix.EPERM) || errors.Is(err, unix.EROFS) { continue } return err