journald: podman events only show events for current user #17253
Conversation
I noticed this while running some things in parallel, podman events would show events from other users. Because all events are written to the journal everybody can see them. So when we read the journal we must filter events for only the current UID. To reproduce run `podman events` as user then in another window create a container as root for example. After this patch it will correctly ignore these events from other users. [NO NEW TESTS NEEDED] I don't think we can test with two users at the same time. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
In the super rare case that there are two containers with the same ID for two different users, podman logs with the journald driver would show logs from both containers. [NO NEW TESTS NEEDED] Impossible to reproduce. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
|
LGTM |
|
/approve |
openshift-ci
bot
added
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Luap99, rhatdan The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
|
/cherrypick v4.4 |
|
@baude: new pull request created: #17254 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
should podman events not support the ability for a superuser to obtain events for all current activity independent of user identity? |
That's not on the roadmap. A superuser can query the journal (e.g., via journalctl) to see the events of all user on the system (including Podman events). |
github-actions
bot
added
the
locked - please file new issue/PR
I noticed this while running some things in parallel, podman events
would show events from other users. Because all events are written to
the journal everybody can see them. So when we read the journal we must
filter events for only the current UID.
To reproduce run
podman eventsas user then in another window create acontainer as root for example. After this patch it will correctly ignore
these events from other users.
[NO NEW TESTS NEEDED] I don't think we can test with two users at the same
time.
journald: podman logs only show logs for current user
In the super rare case that there are two containers with the same ID
for two different users, podman logs with the journald driver would show
logs from both containers.
[NO NEW TESTS NEEDED] Impossible to reproduce.
Does this PR introduce a user-facing change?