e2e: Avoid hard-coding ImageCacheDir #17243
Conversation
test/e2e/common_test.go
Outdated
| @@ -103,6 +103,7 @@ func TestLibpod(t *testing.T) { | |||
|
|
|||
| var _ = SynchronizedBeforeSuite(func() []byte { | |||
| // make cache dir | |||
| ImageCacheDir = filepath.Join(os.TempDir(), "imagecachedir") | |||
| if err := os.MkdirAll(ImageCacheDir, 0777); err != nil { | |||
There was a problem hiding this comment.
The permissions on this directory seems to be too loose. I don't think we should allow different users on the system to share the ImageCacheDir, since it could be an attack route to attack each other.
This should be per user.
There was a problem hiding this comment.
Change ImageCacheDir permissions from 0777 to 0700 .
As far as I can see, this change is no ploblem.
sstosh
force-pushed
the
e2e-imagecachedir
branch
2 times, most recently
from
881d41c to
97a684f
Compare
|
Needs a rebase. |
openshift-merge-robot
added
the
needs-rebase
sstosh
force-pushed
the
e2e-imagecachedir
branch
from
97a684f to
6cbf036
Compare
openshift-merge-robot
removed
the
needs-rebase
sstosh
force-pushed
the
e2e-imagecachedir
branch
from
6cbf036 to
89ebe82
Compare
- ImageCacheDir is hard-coded as "/tmp/podman/imagecachedir". To avoid this hard-coding, I changed it to "os.TempDir()/imagecachedir". - Change ImageCacheDir permissions from 0777 to 0700. This directory should be used by per-user. Signed-off-by: Toshiki Sonoda <[email protected]>
sstosh
force-pushed
the
e2e-imagecachedir
branch
from
89ebe82 to
2682d3a
Compare
|
/approve |
openshift-ci
bot
added
the
approved
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Luap99, rhatdan, sstosh The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/lgtm |
|
|
||
| // ImageCacheDir is initialized at runtime. | ||
| // e.g., filepath.Join(os.TempDir(), "imagecachedir") | ||
| // This directory should be used by per-user. |
There was a problem hiding this comment.
This is technically not true, but oh well, too late
github-actions
bot
added
the
locked - please file new issue/PR
ImageCacheDir is hard-coded as "/tmp/podman/imagecachedir".
To avoid this hard-coding, I changed it to "os.TempDir()/imagecachedir".
Change ImageCacheDir permissions from 0777 to 0700.
This directory should be used by per-user.
Signed-off-by: Toshiki Sonoda [email protected]
Related to #17089
Does this PR introduce a user-facing change?