container/podman
container/podman
1
0
Fork 0
mirror of https://github.com/containers/podman synced 2024-10-19 08:44:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14415 from nicrowe00/14133

Browse source 
no-new-privileges format
This commit is contained in:
OpenShift Merge Robot 2022-05-31 05:07:28 -04:00 committed by GitHub
parent a550af260a 7e69e2b532
commit ccc087a30e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
pkg/specgenutil/specgen.go
View file

@ -622,7 +622,14 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
if opt == "no-new-privileges" {
s.ContainerSecurityConfig.NoNewPrivileges = true
} else {
con := strings.SplitN(opt, "=", 2)
// Docker deprecated the ":" syntax but still supports it,
// so we need to as well
var con []string
if strings.Contains(opt, "=") {
con = strings.SplitN(opt, "=", 2)
} else {
con = strings.SplitN(opt, ":", 2)
}
if len(con) != 2 {
return fmt.Errorf("invalid --security-opt 1: %q", opt)
}
@ -650,6 +657,12 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
}
case "unmask":
s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, con[1:]...)
case "no-new-privileges":
noNewPrivileges, err := strconv.ParseBool(con[1])
if err != nil {
return fmt.Errorf("invalid --security-opt 2: %q", opt)
}
s.ContainerSecurityConfig.NoNewPrivileges = noNewPrivileges
default:
return fmt.Errorf("invalid --security-opt 2: %q", opt)
}

11
test/system/030-run.bats
View file

@ -855,4 +855,15 @@ EOF
run_podman rmi $test_image
}
@test "podman create --security-opt" {
run_podman create --security-opt no-new-privileges=true $IMAGE
run_podman rm $output
run_podman create --security-opt no-new-privileges:true $IMAGE
run_podman rm $output
run_podman create --security-opt no-new-privileges=false $IMAGE
run_podman rm $output
run_podman create --security-opt no-new-privileges $IMAGE
run_podman rm $output
}
# vim: filetype=sh