github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

cri: set default masked/readonly paths to empty paths

Browse Source 
Fixes #5029.

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
This commit is contained in:
Yohei Ueda 2021-02-12 13:56:41 +09:00
parent af4c55fa4a
commit 07f1df4541
No known key found for this signature in database
GPG Key ID: 38F36806B36F6BCD
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/cri/server/container_create_linux.go
View File

@ -195,6 +195,11 @@ func (c *criService) containerSpec(
specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel), customopts.WithRelabeledContainerMounts(mountLabel)) specOpts = append(specOpts, customopts.WithMounts(c.os, config, extraMounts, mountLabel), customopts.WithRelabeledContainerMounts(mountLabel))
if !c.config.DisableProcMount { if !c.config.DisableProcMount {
// Change the default masked/readonly paths to empty slices
// See https://github.com/containerd/containerd/issues/5029
// TODO: Provide an option to set default paths to the ones in oci.populateDefaultUnixSpec()
specOpts = append(specOpts, oci.WithMaskedPaths([]string{}), oci.WithReadonlyPaths([]string{}))
// Apply masked paths if specified. // Apply masked paths if specified.
// If the container is privileged, this will be cleared later on. // If the container is privileged, this will be cleared later on.
if maskedPaths := securityContext.GetMaskedPaths(); maskedPaths != nil { if maskedPaths := securityContext.GetMaskedPaths(); maskedPaths != nil {

4
pkg/cri/server/container_create_linux_test.go
View File

@ -1118,8 +1118,8 @@ func TestMaskedAndReadonlyPaths(t *testing.T) {
disableProcMount: false, disableProcMount: false,
masked: nil, masked: nil,
readonly: nil, readonly: nil,
expectedMasked: defaultSpec.Linux.MaskedPaths, expectedMasked: []string{},
expectedReadonly: defaultSpec.Linux.ReadonlyPaths, expectedReadonly: []string{},
privileged: false, privileged: false,
}, },
"should be able to specify empty paths": { "should be able to specify empty paths": {