container/podman
container/podman
1
0
Fork 0
mirror of https://github.com/containers/podman synced 2024-10-20 17:23:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

exec: honor --privileged

Browse source 
write the capabilities to the configuration passed to the OCI
runtime.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano 2020-12-23 21:53:55 +01:00
parent 2a97639263
commit 2a39a6195a
No known key found for this signature in database
GPG key ID: E4730F97F60286ED
2 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
libpod/oci_conmon_linux.go
View file

@ -1193,6 +1193,13 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio
pspec := c.config.Spec.Process
pspec.SelinuxLabel = c.config.ProcessLabel
pspec.Args = options.Cmd
for _, cap := range options.CapAdd {
pspec.Capabilities.Bounding = append(pspec.Capabilities.Bounding, cap)
pspec.Capabilities.Effective = append(pspec.Capabilities.Effective, cap)
pspec.Capabilities.Inheritable = append(pspec.Capabilities.Inheritable, cap)
pspec.Capabilities.Permitted = append(pspec.Capabilities.Permitted, cap)
pspec.Capabilities.Ambient = append(pspec.Capabilities.Ambient, cap)
}
// We need to default this to false else it will inherit terminal as true
// from the container.
pspec.Terminal = false

15
test/e2e/exec_test.go
View file

@ -119,6 +119,21 @@ var _ = Describe("Podman exec", func() {
Expect(session.ExitCode()).To(Equal(100))
})
It("podman exec --privileged", func() {
hostCap := SystemExec("awk", []string{"/^CapEff/ { print $2 }", "/proc/self/status"})
Expect(hostCap.ExitCode()).To(Equal(0))
setup := podmanTest.RunTopContainer("test-privileged")
setup.WaitWithDefaultTimeout()
Expect(setup.ExitCode()).To(Equal(0))
session := podmanTest.Podman([]string{"exec", "--privileged", "test-privileged", "sh", "-c", "grep ^CapEff /proc/self/status | cut -f 2"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
containerCapMatchesHost(session.OutputToString(), hostCap.OutputToString())
})
It("podman exec terminal doesn't hang", func() {
setup := podmanTest.Podman([]string{"run", "-dti", "--name", "test1", fedoraMinimal, "sleep", "+Inf"})
setup.WaitWithDefaultTimeout()