mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

libct: Use chown(uid, -1) to not change the gid

Browse Source 
There is no behavior change, it is just more readable to use -1 to mean
don't touch this.

Please note that if the GID is not mapped in the userns, by using -1 for
that no error is returned. We just avoid dealing with it completely, as
we want here.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
This commit is contained in:
Rodrigo Campos
2025-03-06 15:02:50 +01:00
parent 92d1ea4acc
commit 9c5e687b6f
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/init_linux.go
+6 -5
View File
@@ -524,16 +524,17 @@ func fixStdioPermissions(uid int) error {
// that users expect to be able to actually use their console. Without
// this code, you couldn't effectively run as a non-root user inside a
// container and also have a console set up.
if err := file.Chown(uid, int(s.Gid)); err != nil {
// If we've hit an EINVAL then s.Gid isn't mapped in the user
// namespace. If we've hit an EPERM then the inode's current owner
if err := file.Chown(uid, -1); err != nil {
// If we've hit an EPERM then the inode's current owner
// is not mapped in our user namespace (in particular,
// privileged_wrt_inode_uidgid() has failed). Read-only
// /dev can result in EROFS error. In any case, it's
// better for us to just not touch the stdio rather
// than bail at this point.
if errors.Is(err, unix.EINVAL) || errors.Is(err, unix.EPERM) || errors.Is(err, unix.EROFS) {
// EINVAL should never happen, as it would mean the uid
// is not mapped, we expect this function to be called
// with a mapped uid.
if errors.Is(err, unix.EPERM) || errors.Is(err, unix.EROFS) {
continue
}
return err