From 2420eb1f4d635f0eb1ec1d1f6c167e553b03a435 Mon Sep 17 00:00:00 2001 From: ynirk Date: Mon, 26 Feb 2018 11:47:15 +0100 Subject: [PATCH] The setupUserNamespace function is always called. The function is called even if the usernamespace is not set. This results having wrong uid/gid set on devices. This fix add a test to check if usernamespace is set befor calling setupUserNamespace. Fixes #1742 Signed-off-by: Julien Lavesque --- libcontainer/specconv/spec_linux.go | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go index 01809d0f2..98fd2e632 100644 --- a/libcontainer/specconv/spec_linux.go +++ b/libcontainer/specconv/spec_linux.go @@ -192,9 +192,6 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) { if err := createDevices(spec, config); err != nil { return nil, err } - if err := setupUserNamespace(spec, config); err != nil { - return nil, err - } c, err := createCgroupConfig(opts) if err != nil { return nil, err @@ -226,6 +223,11 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) { }, } } + if config.Namespaces.Contains(configs.NEWUSER) { + if err := setupUserNamespace(spec, config); err != nil { + return nil, err + } + } config.MaskPaths = spec.Linux.MaskedPaths config.ReadonlyPaths = spec.Linux.ReadonlyPaths config.MountLabel = spec.Linux.MountLabel