libcontainer: skip chown of /dev/null caused by fd redirection #3707
Conversation
|
I think this may be fixing #3674, but the reporter there never provided reproduction steps. |
cyphar
added
the
backport/1.1-todo
|
LGTM, however we require a DCO for all commits (just do @kolyshkin It seems we broke this in #3345. |
Done.
Is this format of commit reference OK? |
|
This is a commit to the main branch thus the milestone should be set to 1.2.0. Indeed we need to backport it to |
|
Ah! I finally got a reproducer for this, currently being tested in #3720. |
|
Can you please rebase and pick up 65c94b8 ? Something like wget https://github.com/opencontainers/runc/pull/3720/commits/65c94b899ed0c7c5bceeec5c515990c392894db8.patch
git am 65c94b899ed0c7c5bceeec5c515990c392894db8.patchshould work |
In 18c4760 (libct: fixStdioPermissions: skip chown if not needed) the check whether the STDIO file descriptors point to /dev/null was removed which can cause /dev/null to change ownership e.g. when using docker exec on a running container: $ ls -l /dev/null crw-rw-rw- 1 root root 1, 3 Aug 1 14:12 /dev/null $ docker exec -u test 0ad6d3064e9d ls $ ls -l /dev/null crw-rw-rw- 1 test root 1, 3 Aug 1 14:12 /dev/null Signed-off-by: Jaroslav Jindrak <dzejrou@gmail.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Done, I hope. |
|
@cyphar @AkihiroSuda @thaJeztah PTAL (once this is in, we need to backport to 1.1 and release 1.1.5) |
|
1.1 backport: #3731 |
kolyshkin
removed
the
backport/1.1-todo
kolyshkin
added
the
backport/1.1-done
In #3355 the check whether the STDIO file descriptors point to /dev/null was removed which can cause /dev/null to change ownership e.g. when using docker exec on a running container:
$ ls -l /dev/null
crw-rw-rw- 1 root root 1, 3 Aug 1 14:12 /dev/null
$ docker exec -u test 0ad6d3064e9d ls
$ ls -l /dev/null
crw-rw-rw- 1 test root 1, 3 Aug 1 14:12 /dev/null
This PR reintroduces that check and fixes the issue for me on runc v1.1.{3,4} (I did not find any information about this change being intentional, if it was feel free to close this PR).
Fixes: #3674