github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Merge pull request #1570 from yoheiueda/masked

Browse Source 
Set masked and readonly paths based on default Unix spec
This commit is contained in:
Mike Brown 2020-09-24 15:45:58 -05:00 committed by GitHub
commit b1ee4c0d7b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/server/container_create_unix.go
View File

@ -182,11 +182,15 @@ func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint3
if !c.config.DisableProcMount { if !c.config.DisableProcMount {
// Apply masked paths if specified. // Apply masked paths if specified.
// If the container is privileged, this will be cleared later on. // If the container is privileged, this will be cleared later on.
specOpts = append(specOpts, oci.WithMaskedPaths(securityContext.GetMaskedPaths())) if maskedPaths := securityContext.GetMaskedPaths(); maskedPaths != nil {
specOpts = append(specOpts, oci.WithMaskedPaths(maskedPaths))
}
// Apply readonly paths if specified. // Apply readonly paths if specified.
// If the container is privileged, this will be cleared later on. // If the container is privileged, this will be cleared later on.
specOpts = append(specOpts, oci.WithReadonlyPaths(securityContext.GetReadonlyPaths())) if readonlyPaths := securityContext.GetReadonlyPaths(); readonlyPaths != nil {
specOpts = append(specOpts, oci.WithReadonlyPaths(readonlyPaths))
}
} }
if securityContext.GetPrivileged() { if securityContext.GetPrivileged() {

6
pkg/server/container_create_unix_test.go
View File

@ -959,12 +959,12 @@ func TestMaskedAndReadonlyPaths(t *testing.T) {
expectedReadonly: defaultSpec.Linux.ReadonlyPaths, expectedReadonly: defaultSpec.Linux.ReadonlyPaths,
privileged: false, privileged: false,
}, },
"should always apply CRI specified paths when disable_proc_mount = false": { "should apply default if not specified when disable_proc_mount = false": {
disableProcMount: false, disableProcMount: false,
masked: nil, masked: nil,
readonly: nil, readonly: nil,
expectedMasked: nil, expectedMasked: defaultSpec.Linux.MaskedPaths,
expectedReadonly: nil, expectedReadonly: defaultSpec.Linux.ReadonlyPaths,
privileged: false, privileged: false,
}, },
"should be able to specify empty paths": { "should be able to specify empty paths": {