Add filepath glob support to --security-opt unmask #10185
Conversation
openshift-ci-robot
added
the
approved
rhatdan
force-pushed
the
volume
branch
2 times, most recently
from
5e465a4 to
7386792
Compare
|
@rhatdan still fighting the CI test system |
|
@containers/podman-maintainers PTAL |
| @@ -5,6 +5,7 @@ ipcns="host" | |||
| utsns="host" | |||
| cgroupns="host" | |||
| cgroups="disabled" | |||
| log_driver = "k8s_file" | |||
There was a problem hiding this comment.
Yes it is a separate PR, Could add it as a fully separate from this, but I figured I would sneak it in while I was thinking about it.
pkg/util/utils.go
Outdated
| @@ -76,6 +76,24 @@ func ParseRegistryCreds(creds string) (*types.DockerAuthConfig, error) { | |||
| }, nil | |||
| } | |||
|
|
|||
| func ShouldMask(mask string, unmask []string) bool { | |||
There was a problem hiding this comment.
Since there's only one callers, can we move it into pkg/specgen/generate?
There was a problem hiding this comment.
Code comments and unit tests would be nice.
Signed-off-by: Daniel J Walsh <[email protected]>
Want to allow users to specify --security-opt unmask=/proc/*. This allows us to run podman within podman more securely, then specifing umask=all, also gives the user more flexibilty. Signed-off-by: Daniel J Walsh <[email protected]>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe, rhatdan The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
LGTM |
|
/lgtm |
github-actions
bot
added
the
locked - please file new issue/PR
Want to allow users to specify --security-opt unmask=/proc/*.
This allows us to run podman within podman more securely, then
specifing umask=all, also gives the user more flexibilty.
Signed-off-by: Daniel J Walsh [email protected]