vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #1027 from umohnani8/secrets_1.0

Browse source 
Fix logic flaw in secrets mount
This commit is contained in:
Mrunal Patel 2017-10-17 13:56:42 -07:00 committed by GitHub
commit 70f6306a51
3 changed files with 7 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
server/container_create.go
View file

@ -393,7 +393,6 @@ func addSecretsBindMounts(mountLabel, ctrRunDir string, defaultMounts []string,
} }
for _, m := range mounts { for _, m := range mounts {
specgen.AddBindMount(m.Source, m.Destination, nil) specgen.AddBindMount(m.Source, m.Destination, nil)
} }
return nil return nil
} }

12
server/secrets.go
View file

@ -113,18 +113,18 @@ func secretMounts(defaultMountsPaths []string, mountLabel, containerWorkingDir s
continue continue
} }
ctrDir = filepath.Join(containerWorkingDir, ctrDir) ctrDirOnHost := filepath.Join(containerWorkingDir, ctrDir)
// skip if ctrDir has already been mounted by caller // skip if ctrDir has already been mounted by caller
if isAlreadyMounted(runtimeMounts, ctrDir) { if isAlreadyMounted(runtimeMounts, ctrDir) {
logrus.Warnf("%q has already been mounted; cannot override mount", ctrDir) logrus.Warnf("%q has already been mounted; cannot override mount", ctrDir)
continue continue
} }
if err := os.RemoveAll(ctrDir); err != nil { if err := os.RemoveAll(ctrDirOnHost); err != nil {
return nil, fmt.Errorf("remove container directory failed: %v", err) return nil, fmt.Errorf("remove container directory failed: %v", err)
} }
if err := os.MkdirAll(ctrDir, 0755); err != nil { if err := os.MkdirAll(ctrDirOnHost, 0755); err != nil {
return nil, fmt.Errorf("making container directory failed: %v", err) return nil, fmt.Errorf("making container directory failed: %v", err)
} }
@ -138,12 +138,12 @@ func secretMounts(defaultMountsPaths []string, mountLabel, containerWorkingDir s
return nil, errors.Wrapf(err, "getting host secret data failed") return nil, errors.Wrapf(err, "getting host secret data failed")
} }
for _, s := range data { for _, s := range data {
s.SaveTo(ctrDir) s.SaveTo(ctrDirOnHost)
} }
label.Relabel(ctrDir, mountLabel, false) label.Relabel(ctrDirOnHost, mountLabel, false)
m := rspec.Mount{ m := rspec.Mount{
Source: hostDir, Source: ctrDirOnHost,
Destination: ctrDir, Destination: ctrDir,
} }

2
test/crio_secrets.bats
View file

@ -24,7 +24,7 @@ function teardown() {
echo "$output" echo "$output"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
mount_info="$output" mount_info="$output"
grep $ctr_id/userdata/container/path1 <<< "$mount_info" grep /container/path1 <<< "$mount_info"
echo "$output" echo "$output"
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
rm -rf MOUNT_PATH rm -rf MOUNT_PATH