From f26ec92221e68b2c81cbc0c72489a3f0135f4d6c Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 15 Jan 2025 23:28:08 -0800 Subject: [PATCH] libct: rm Rootless* properties from initConfig They are passed in initConfig twice, so it does not make sense. NB: the alternative to that would be to remove Config field from initConfig, but it results in a much bigger patch and more maintenance down the road. Signed-off-by: Kir Kolyshkin --- libcontainer/container_linux.go | 2 -- libcontainer/init_linux.go | 8 +------- libcontainer/rootfs_linux.go | 2 +- 3 files changed, 2 insertions(+), 10 deletions(-) diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go index 15090fe2e..3ee0cb2c2 100644 --- a/libcontainer/container_linux.go +++ b/libcontainer/container_linux.go @@ -704,8 +704,6 @@ func (c *Container) newInitConfig(process *Process) *initConfig { PassedFilesCount: len(process.ExtraFiles), ContainerID: c.ID(), NoNewPrivileges: c.config.NoNewPrivileges, - RootlessEUID: c.config.RootlessEUID, - RootlessCgroups: c.config.RootlessCgroups, AppArmorProfile: c.config.AppArmorProfile, ProcessLabel: c.config.ProcessLabel, Rlimits: c.config.Rlimits, diff --git a/libcontainer/init_linux.go b/libcontainer/init_linux.go index b2cae3a84..fba9bb32c 100644 --- a/libcontainer/init_linux.go +++ b/libcontainer/init_linux.go @@ -82,12 +82,6 @@ type initConfig struct { ProcessLabel string `json:"process_label"` Rlimits []configs.Rlimit `json:"rlimits"` - // Properties that only exist in container config. - // FIXME: they are also passed in Config above. - - RootlessEUID bool `json:"rootless_euid,omitempty"` - RootlessCgroups bool `json:"rootless_cgroups,omitempty"` - // Miscellaneous properties, filled in by [Container.newInitConfig] // unless documented otherwise. @@ -484,7 +478,7 @@ func setupUser(config *initConfig) error { // There's nothing we can do about /etc/group entries, so we silently // ignore setting groups here (since the user didn't explicitly ask us to // set the group). - allowSupGroups := !config.RootlessEUID && string(bytes.TrimSpace(setgroups)) != "deny" + allowSupGroups := !config.Config.RootlessEUID && string(bytes.TrimSpace(setgroups)) != "deny" if allowSupGroups { if err := unix.Setgroups(config.AdditionalGroups); err != nil { diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go index 012b05067..68e16b792 100644 --- a/libcontainer/rootfs_linux.go +++ b/libcontainer/rootfs_linux.go @@ -106,7 +106,7 @@ func prepareRootfs(pipe *syncSocket, iConfig *initConfig) (err error) { root: config.Rootfs, label: config.MountLabel, cgroup2Path: iConfig.Cgroup2Path, - rootlessCgroups: iConfig.RootlessCgroups, + rootlessCgroups: config.RootlessCgroups, cgroupns: config.Namespaces.Contains(configs.NEWCGROUP), } for _, m := range config.Mounts {