mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 14:13:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix permission denied

Browse Source 
when exec as root and config.Cwd is not owned by root, exec will fail
because root doesn't have the caps.

So, Chdir should be done before setting the caps.

Signed-off-by: Kurnia D Win <kurnia.d.win@gmail.com>
This commit is contained in:
Kurnia D Win
2019-07-18 05:57:23 +07:00
parent 6cccc1760d
commit 5e0e67d76c
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/init_linux.go
+6 -5
View File
@@ -127,6 +127,12 @@ func finalizeNamespace(config *initConfig) error {
return errors.Wrap(err, "close exec fds")
}
if config.Cwd != "" {
if err := unix.Chdir(config.Cwd); err != nil {
return fmt.Errorf("chdir to cwd (%q) set in config.json failed: %v", config.Cwd, err)
}
}
capabilities := &configs.Capabilities{}
if config.Capabilities != nil {
capabilities = config.Capabilities
@@ -154,11 +160,6 @@ func finalizeNamespace(config *initConfig) error {
if err := w.ApplyCaps(); err != nil {
return errors.Wrap(err, "apply caps")
}
if config.Cwd != "" {
if err := unix.Chdir(config.Cwd); err != nil {
return fmt.Errorf("chdir to cwd (%q) set in config.json failed: %v", config.Cwd, err)
}
}
return nil
}