vbatts/containerd
1
0
Fork 0
Code Pull requests Releases Activity

set +x on overlay fs dirs

Browse source 
We need to set +x on the overlay dirs or after dropping from root to a
non-root user an eperm will happen on exec or other file access

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This commit is contained in:
Michael Crosby 2017-03-24 12:47:52 -07:00
parent 597815af7e
commit 71e8d765df
3 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
cmd/ctr/run.go
View file

@ -113,6 +113,13 @@ func spec(id string, config *ocispec.ImageConfig, context *cli.Context) (*specs.
Effective: capabilities, Effective: capabilities,
Ambient: capabilities, Ambient: capabilities,
}, },
Rlimits: []specs.LinuxRlimit{
{
Type: "RLIMIT_NOFILE",
Hard: uint64(1024),
Soft: uint64(1024),
},
},
}, },
Mounts: []specs.Mount{ Mounts: []specs.Mount{
{ {
@ -311,7 +318,7 @@ var runCommand = cli.Command{
} }
var imageConfig ocispec.Image var imageConfig ocispec.Image
switch ic.MediaType { switch ic.MediaType {
case ocispec.MediaTypeImageConfig, "application/vnd.docker.container.image.v1+json": case ocispec.MediaTypeImageConfig, images.MediaTypeDockerSchema2Config:
r, err := provider.Reader(ctx, ic.Digest) r, err := provider.Reader(ctx, ic.Digest)
if err != nil { if err != nil {
return err return err

2
linux/runtime.go
View file

@ -41,7 +41,7 @@ type Config struct {
} }
func New(ic *plugin.InitContext) (interface{}, error) { func New(ic *plugin.InitContext) (interface{}, error) {
path := filepath.Join(ic.Root, runtimeName) path := filepath.Join(ic.State, runtimeName)
if err := os.MkdirAll(path, 0700); err != nil { if err := os.MkdirAll(path, 0700); err != nil {
return nil, err return nil, err
} }

3
snapshot/overlay/overlay.go
View file

@ -47,7 +47,6 @@ func NewSnapshotter(root string, ms storage.MetaStore) (snapshot.Snapshotter, er
if err := os.MkdirAll(root, 0700); err != nil { if err := os.MkdirAll(root, 0700); err != nil {
return nil, err return nil, err
} }
if err := os.MkdirAll(filepath.Join(root, "snapshots"), 0700); err != nil { if err := os.MkdirAll(filepath.Join(root, "snapshots"), 0700); err != nil {
return nil, err return nil, err
} }
@ -189,7 +188,7 @@ func (o *Snapshotter) createActive(ctx context.Context, key, parent string, read
} }
}() }()
if err = os.MkdirAll(filepath.Join(td, "fs"), 0700); err != nil { if err = os.MkdirAll(filepath.Join(td, "fs"), 0711); err != nil {
return nil, err return nil, err
} }
if !readonly { if !readonly {