Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

podman cp: ignore EPERMs in rootless mode #9630

Merged
merged 5 commits into from
Mar 9, 2021
Merged

podman cp: ignore EPERMs in rootless mode #9630

merged 5 commits into from
Mar 9, 2021

Conversation

vrothberg
Copy link
Member

Ignore permission errors when copying from a rootless container.
TTY devices inside rootless containers are owned by the host's
root user which is "nobody" inside the container's user namespace
rendering us unable to even read them.

Enable the integration test which was temporarily disabled for rootless
users.

Signed-off-by: Valentin Rothberg [email protected]

Note: I broke out the vendor commit for buildah@master to make the fixes easier to backport if needed.

@containers/podman-maintainers @giuseppe PTAL

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 5, 2021
giuseppe
giuseppe approved these changes Mar 5, 2021
View reviewed changes
Copy link
Member

@giuseppe giuseppe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@vrothberg vrothberg force-pushed the cp-rootless-eperms branch from 19c97e7 to 0bad4f5 Compare March 5, 2021 09:49
@rhatdan
Copy link
Member

rhatdan commented Mar 5, 2021

/lgtm
/hold

@openshift-ci-robot openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 5, 2021
@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 5, 2021
@vrothberg
Copy link
Member Author

*sigh ... the seccomp issues seem to still not be fixed

@vrothberg
Copy link
Member Author

Blocked on #9554

@openshift-ci-robot openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Mar 5, 2021
@vrothberg
Copy link
Member Author

Added another to commit to fix the ownership issues reported in #9626

@rhatdan
Copy link
Member

rhatdan commented Mar 5, 2021

LGTM
@giuseppe PTAL at the new patch.

giuseppe
giuseppe approved these changes Mar 5, 2021
View reviewed changes
Copy link
Member

@giuseppe giuseppe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@openshift-ci-robot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, vrothberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@mheon
Copy link
Member

mheon commented Mar 5, 2021

LGTM once #9554 merges

@vrothberg
Copy link
Member Author

I have some more fixes in the pipeline :^)

This was referenced Mar 5, 2021
Closed
Merged
@vrothberg vrothberg force-pushed the cp-rootless-eperms branch from 0fd8bdb to 02ff0f9 Compare March 5, 2021 15:14
@openshift-ci-robot openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 5, 2021
@vrothberg
Copy link
Member Author

/hold
Need to get containers/buildah#3064 merged and released.

@vrothberg vrothberg force-pushed the cp-rootless-eperms branch from 02ff0f9 to 0f23722 Compare March 5, 2021 15:49
@openshift-ci-robot openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 5, 2021
@openshift-ci-robot openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 7, 2021
@vrothberg vrothberg force-pushed the cp-rootless-eperms branch from 0f23722 to 355e3a3 Compare March 8, 2021 15:21
@openshift-ci-robot openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 8, 2021
@vrothberg
Copy link
Member Author

Vendoring buildah@master again. Let's see what goes into 3.1

@vrothberg vrothberg force-pushed the cp-rootless-eperms branch from 355e3a3 to 0bc328c Compare March 9, 2021 08:00
@vrothberg
Copy link
Member Author

/hold cancel

@openshift-ci-robot openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 9, 2021
vrothberg added 4 commits March 9, 2021 09:02
@vrothberg
vendor [email protected]
d175fbf 
Signed-off-by: Valentin Rothberg <[email protected]>
@vrothberg
podman cp: ignore EPERMs in rootless mode
2abfef3 
Ignore permission errors when copying from a rootless container.
TTY devices inside rootless containers are owned by the host's
root user which is "nobody" inside the container's user namespace
rendering us unable to even read them.

Enable the integration test which was temporarily disabled for rootless
users.

Signed-off-by: Valentin Rothberg <[email protected]>
@vrothberg
podman cp: fix ownership
a61d70c 
Make sure the files are chowned to the host/container user, depending on
where things are being copied to.

Fixes: containers#9626
Signed-off-by: Valentin Rothberg <[email protected]>
@vrothberg
podman cp: fix copying to a non-existent dir
31b11b5 
Copy is full of perils.  Some of them are the nuances when copying
directories.  Who would have thought that
 * cp dir   foo
 * cp dir/  foo
 * cp dir/. foo
are all supposed to yield the same result when foo does not exist.

`podman cp` now supports all three notations, which required to massage
the front-end code in `cmd/podman` a bit.  The tests have been extended
and partially rewritten to test container->host and host->container
copy operations.

Signed-off-by: Valentin Rothberg <[email protected]>
@vrothberg vrothberg force-pushed the cp-rootless-eperms branch from 0bc328c to 0e38d91 Compare March 9, 2021 08:02
@vrothberg
Copy link
Member Author

@eriksjolund, the commits should fix the bugs you reported. Thank you again!

@containers/podman-maintainers PTAL. Note that there are still some subtle differences between Docker and Podman. For instance, Docker does NOT allow to copy symlinks from the host that escape the path.

For instance, cp dir/foo with "dir/foo" pointing outside of "dir/" is considered an invalid path. Podman allows that but I am hesitant to change that for now.

@vrothberg vrothberg force-pushed the cp-rootless-eperms branch from 0e38d91 to cee76f4 Compare March 9, 2021 08:17
@vrothberg
podman cp: evaluate symlink correctly when copying from container
1f2f7e7 
When copying from a container, make sure to evaluate the symlinks
correctly.  Add tests copying a symlinked directory from a running and
a non-running container to execute both path-resolution paths.

Signed-off-by: Valentin Rothberg <[email protected]>
@vrothberg vrothberg force-pushed the cp-rootless-eperms branch from cee76f4 to 1f2f7e7 Compare March 9, 2021 09:47
@vrothberg
Copy link
Member Author

Merge me

@vrothberg
Copy link
Member Author

Merge me :)

@giuseppe
Copy link
Member

giuseppe commented Mar 9, 2021

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 9, 2021
@openshift-merge-robot openshift-merge-robot merged commit 66ac942 into containers:master Mar 9, 2021
@vrothberg vrothberg deleted the cp-rootless-eperms branch March 9, 2021 13:42
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 23, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@TomSweeneyRedHat TomSweeneyRedHat TomSweeneyRedHat left review comments

@giuseppe giuseppe giuseppe approved these changes

Assignees

@giuseppe giuseppe

@rhatdan rhatdan

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@vrothberg @rhatdan @openshift-ci-robot @mheon @giuseppe @TomSweeneyRedHat @openshift-merge-robot