Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use fixed uid/gid for vtpm container #3999

Merged
merged 1 commit into from
Jun 25, 2024
Merged

Use fixed uid/gid for vtpm container #3999

merged 1 commit into from
Jun 25, 2024

Conversation

shjala
Copy link
Member

@shjala shjala commented Jun 25, 2024 •
edited
Loading

Use the fixed ids create in dom0 to run the VTPM container, this allows to run the container as non-root user and have control over the access control as described in #3989 .

linuxkit-525400123456:~# ps aux | grep vtpm
 1540 root      0:00 /usr/bin/containerd-shim-runc-v2 -namespace services.linuxkit -id vtpm -address /run/containerd/containerd.sock
 1561 vtpm      0:00 {init.sh} /bin/sh /usr/bin/init.sh
 1629 vtpm      0:00 /usr/bin/vtpm_server
 3297 root      0:00 grep vtpm

@shjala
Use fixed uid/gid for vtpm container
5fe473c 
Use the fixed ids create in dom0 to run the VTPM container, this allows
to run the container as non-root user and have control over the access
control as described in lf-edge#3986 .

Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>
@github-actions github-actions bot requested a review from eriknordmark June 25, 2024 14:57
@shjala shjala force-pushed the vtpm-numeric-ids branch from cf67036 to 5fe473c Compare June 25, 2024 14:57
eriknordmark
eriknordmark approved these changes Jun 25, 2024
View reviewed changes
Copy link
Contributor

@eriknordmark eriknordmark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Should we also update the hash for other references to eve-dom0-ztools ? Or are the others up to date?

@shjala
Copy link
Member Author

shjala commented Jun 25, 2024

LGTM

Should we also update the hash for other references to eve-dom0-ztools ? Or are the others up to date?

don't think so, I'll do in another PR.

@shjala
Copy link
Member Author

shjala commented Jun 25, 2024

@eriknordmark apart from vtpm, only pillar uses lfedge/eve-dom0-ztools, I'll wait for @andrewd-zededa #3996 and then update both vtpm and pillar.

@eriknordmark eriknordmark merged commit 7b35a22 into lf-edge:master Jun 25, 2024
22 of 32 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@eriknordmark eriknordmark eriknordmark approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@shjala @eriknordmark