kubernetes

github/kubernetes

Fork 0

Commit Graph

Author	SHA1	Message	Date
Jan Safranek	5110db5087	Lock subPath volumes Users must not be allowed to step outside the volume with subPath. Therefore the final subPath directory must be "locked" somehow and checked if it's inside volume. On Windows, we lock the directories. On Linux, we bind-mount the final subPath into /var/lib/kubelet/pods/<uid>/volume-subpaths/<container name>/<subPathName>, it can't be changed to symlink user once it's bind-mounted.	2018-03-05 09:14:44 +01:00
Jan Safranek	790f513d23	Fix cross-compliation of mount_exec.go Add dummy implementation for non-linux platforms	2017-11-14 16:30:00 +01:00

Author

SHA1

Message

Date

Jan Safranek

5110db5087

Lock subPath volumes

Users must not be allowed to step outside the volume with subPath.
Therefore the final subPath directory must be "locked" somehow
and checked if it's inside volume.

On Windows, we lock the directories. On Linux, we bind-mount the final
subPath into /var/lib/kubelet/pods/<uid>/volume-subpaths/<container name>/<subPathName>,
it can't be changed to symlink user once it's bind-mounted.

2018-03-05 09:14:44 +01:00

Jan Safranek

790f513d23

Fix cross-compliation of mount_exec.go

Add dummy implementation for non-linux platforms

2017-11-14 16:30:00 +01:00

2 Commits