github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Windows:Create root/state with ACL

Browse Source 
Signed-off-by: John Howard <jhoward@microsoft.com>
This commit is contained in:
John Howard 2019-03-21 18:47:34 -07:00
parent ceba56893a
commit 6034c1950a
3 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
services/server/server.go
View File

@ -43,6 +43,7 @@ import (
srvconfig "github.com/containerd/containerd/services/server/config"
"github.com/containerd/containerd/snapshots"
ssproxy "github.com/containerd/containerd/snapshots/proxy"
"github.com/containerd/containerd/sys"
metrics "github.com/docker/go-metrics"
grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
"github.com/pkg/errors"
@ -61,10 +62,10 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
return errors.New("root and state must be different paths")
}
if err := os.MkdirAll(config.Root, 0711); err != nil {
if err := sys.MkdirAllWithACL(config.Root, 0711); err != nil {
return err
}
if err := os.MkdirAll(config.State, 0711); err != nil {
if err := sys.MkdirAllWithACL(config.State, 0711); err != nil {
return err
}
return nil

5
sys/filesys_unix.go
View File

@ -24,3 +24,8 @@ import "os"
func ForceRemoveAll(path string) error {
return os.RemoveAll(path)
}
// MkdirAllWithACL is a wrapper for os.MkdirAll on Unix systems.
func MkdirAllWithACL(path string, perm os.FileMode) error {
return os.MkdirAll(path, perm)
}

10
sys/filesys_windows.go
View File

@ -30,6 +30,11 @@ import (
"github.com/Microsoft/hcsshim"
)
const (
// SddlAdministratorsLocalSystem is local administrators plus NT AUTHORITY\System
SddlAdministratorsLocalSystem = "D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)"
)
// MkdirAllWithACL is a wrapper for MkdirAll that creates a directory
// ACL'd for Builtin Administrators and Local System.
func MkdirAllWithACL(path string, perm os.FileMode) error {
@ -78,7 +83,7 @@ func mkdirall(path string, adminAndLocalSystem bool) error {
if j > 1 {
// Create parent
err = mkdirall(path[0:j-1], false)
err = mkdirall(path[0:j-1], adminAndLocalSystem)
if err != nil {
return err
}
@ -112,8 +117,7 @@ func mkdirall(path string, adminAndLocalSystem bool) error {
// and Local System.
func mkdirWithACL(name string) error {
sa := syscall.SecurityAttributes{Length: 0}
sddl := "D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)"
sd, err := winio.SddlToSecurityDescriptor(sddl)
sd, err := winio.SddlToSecurityDescriptor(SddlAdministratorsLocalSystem)
if err != nil {
return &os.PathError{Op: "mkdir", Path: name, Err: err}
}