add namespace check for uid/gid mappings #199
Conversation
| @@ -340,6 +336,14 @@ func checkLinux(spec rspec.Spec, rootfs string, hostCheck bool) (msgs []string) | |||
| } | |||
| } | |||
|
|
|||
| if (len(spec.Linux.UIDMappings) > 0 || len(spec.Linux.GIDMappings) > 0) && !userExists { | |||
| msgs = append(msgs, "UID/GID mappings require User namespace exists") | |||
There was a problem hiding this comment.
The phrasing used by existing similar warnings is:
{setting} requires a new {type} namespace to be specified as well
There was a problem hiding this comment.
On 08/24/2016 12:50 AM, W. Trevor King wrote:
The phrasing used by existing similar warnings is:
{setting} requires a new {type} namespace to be specified as wellI think container joins into an existing user namespace also can work.
Doesn't it?
There was a problem hiding this comment.
On Tue, Aug 23, 2016 at 05:58:31PM -0700, Ma Shimiao wrote:
- if (len(spec.Linux.UIDMappings) > 0 || len(spec.Linux.GIDMappings) > 0) && !userExists {
msgs = append(msgs, "UID/GID mappings require User namespace exists")08/24/2016 12:50 AM, W. Trevor King:
The phrasing used by existing similar warnings is:
{setting} requires a new {type} namespace to be specified as wellI think container joins into an existing user namespace also can
work. Doesn't it?
The kernel has no problem with join-and-tweak, but the OCI spec does
not allow it at the moment [1,2]. Interestingly, the spec places no
such restriction on namespaces inherited from the host. I've filed
3 to figure out what the runtime-spec maintainers want to do about
that.
There was a problem hiding this comment.
Thanks, got it.
Since spec does not allow now, I fixed error message as you suggested.
Signed-off-by: Ma Shimiao <[email protected]>
Mashimiao
force-pushed
the
add-namespace-check-for-mappings
branch
from
b477536 to
bf50b73
Compare
|
LGTM |
Signed-off-by: Ma Shimiao <[email protected]> Backported to v1.0.0.rc1 from bf50b73 opencontainers#199 (cherry-pick applied cleanly). Signed-off-by: W. Trevor King <[email protected]>
Signed-off-by: Ma Shimiao [email protected]