-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
libcontainer: skip chown of /dev/null caused by fd redirection #3707
Conversation
I think this may be fixing #3674, but the reporter there never provided reproduction steps. |
LGTM, however we require a DCO for all commits (just do @kolyshkin It seems we broke this in #3345. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The change looks good to me. I spent some time last week trying to create a repro but couldn't.
Can you please change the commit message to point to a commit (rather that GitHub PR)? Otherwise LGTM
Done.
Is this format of commit reference OK? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
This is a commit to the main branch thus the milestone should be set to 1.2.0. Indeed we need to backport it to |
Ah! I finally got a reproducer for this, currently being tested in #3720. |
Can you please rebase and pick up 65c94b8 ? Something like wget https://github.com/opencontainers/runc/pull/3720/commits/65c94b899ed0c7c5bceeec5c515990c392894db8.patch
git am 65c94b899ed0c7c5bceeec5c515990c392894db8.patch should work |
In 18c4760 (libct: fixStdioPermissions: skip chown if not needed) the check whether the STDIO file descriptors point to /dev/null was removed which can cause /dev/null to change ownership e.g. when using docker exec on a running container: $ ls -l /dev/null crw-rw-rw- 1 root root 1, 3 Aug 1 14:12 /dev/null $ docker exec -u test 0ad6d3064e9d ls $ ls -l /dev/null crw-rw-rw- 1 test root 1, 3 Aug 1 14:12 /dev/null Signed-off-by: Jaroslav Jindrak <dzejrou@gmail.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Done, I hope. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@cyphar @AkihiroSuda @thaJeztah PTAL (once this is in, we need to backport to 1.1 and release 1.1.5) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, thanks!
1.1 backport: #3731 |
In #3355 the check whether the STDIO file descriptors point to /dev/null was removed which can cause /dev/null to change ownership e.g. when using docker exec on a running container:
$ ls -l /dev/null
crw-rw-rw- 1 root root 1, 3 Aug 1 14:12 /dev/null
$ docker exec -u test 0ad6d3064e9d ls
$ ls -l /dev/null
crw-rw-rw- 1 test root 1, 3 Aug 1 14:12 /dev/null
This PR reintroduces that check and fixes the issue for me on runc v1.1.{3,4} (I did not find any information about this change being intentional, if it was feel free to close this PR).
Fixes: #3674