Accepting request 1002913 from home:dancermak:branches:devel:microos
Drop merged patch OBS-URL: https://build.opensuse.org/request/show/1002913 OBS-URL: https://build.opensuse.org/package/show/devel:microos/buildah?expand=0&rev=8
This commit is contained in:
parent
0eafdb97e3
commit
deec28d257
@ -1,90 +0,0 @@
|
|||||||
From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Aditya R <arajan@redhat.com>
|
|
||||||
Date: Wed, 24 Aug 2022 08:42:23 +0530
|
|
||||||
Subject: [PATCH] run: add container gid to additional groups
|
|
||||||
|
|
||||||
When container is created with specific uid and gid also add container
|
|
||||||
gid to supplementary/additional group.
|
|
||||||
|
|
||||||
Signed-off-by: Aditya R <arajan@redhat.com>
|
|
||||||
---
|
|
||||||
run_common.go | 1 +
|
|
||||||
tests/bud.bats | 16 ++++++++++++++++
|
|
||||||
tests/bud/supplemental-groups/Dockerfile | 3 +++
|
|
||||||
tests/run.bats | 14 ++++++++++++++
|
|
||||||
4 files changed, 34 insertions(+)
|
|
||||||
create mode 100644 tests/bud/supplemental-groups/Dockerfile
|
|
||||||
|
|
||||||
diff --git a/run_common.go b/run_common.go
|
|
||||||
index 2054c56527..f5a5ec8505 100644
|
|
||||||
--- a/run_common.go
|
|
||||||
+++ b/run_common.go
|
|
||||||
@@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
|
|
||||||
}
|
|
||||||
g.SetProcessUID(user.UID)
|
|
||||||
g.SetProcessGID(user.GID)
|
|
||||||
+ g.AddProcessAdditionalGid(user.GID)
|
|
||||||
for _, gid := range user.AdditionalGids {
|
|
||||||
g.AddProcessAdditionalGid(gid)
|
|
||||||
}
|
|
||||||
diff --git a/tests/bud.bats b/tests/bud.bats
|
|
||||||
index a37e418b41..07bdf45cac 100644
|
|
||||||
--- a/tests/bud.bats
|
|
||||||
+++ b/tests/bud.bats
|
|
||||||
@@ -366,6 +366,22 @@ _EOF
|
|
||||||
expect_output --substring "invalid response status"
|
|
||||||
}
|
|
||||||
|
|
||||||
+@test "build test has gid in supplemental groups" {
|
|
||||||
+ _prefetch alpine
|
|
||||||
+ run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
|
|
||||||
+ # gid 1000 must be in supplemental groups
|
|
||||||
+ expect_output --substring "Groups: 1000"
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+@test "build test if supplemental groups has gid with --isolation chroot" {
|
|
||||||
+ test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
|
|
||||||
+
|
|
||||||
+ _prefetch alpine
|
|
||||||
+ run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
|
|
||||||
+ # gid 1000 must be in supplemental groups
|
|
||||||
+ expect_output --substring "Groups: 1000"
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
# Test skipping images with FROM
|
|
||||||
@test "build-test skipping unwanted stages with FROM" {
|
|
||||||
mkdir -p ${TEST_SCRATCH_DIR}/bud/platform
|
|
||||||
diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
|
|
||||||
new file mode 100644
|
|
||||||
index 0000000000..462d9ea7a4
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/tests/bud/supplemental-groups/Dockerfile
|
|
||||||
@@ -0,0 +1,3 @@
|
|
||||||
+FROM alpine
|
|
||||||
+USER 1000:1000
|
|
||||||
+RUN cat /proc/$$/status
|
|
||||||
diff --git a/tests/run.bats b/tests/run.bats
|
|
||||||
index 2e8836c470..e34091fcbe 100644
|
|
||||||
--- a/tests/run.bats
|
|
||||||
+++ b/tests/run.bats
|
|
||||||
@@ -349,6 +349,20 @@ function configure_and_check_user() {
|
|
||||||
expect_output "888:888"
|
|
||||||
}
|
|
||||||
|
|
||||||
+@test "run --user and verify gid in supplemental groups" {
|
|
||||||
+ skip_if_no_runtime
|
|
||||||
+
|
|
||||||
+ # Create the container.
|
|
||||||
+ _prefetch alpine
|
|
||||||
+ run_buildah from $WITH_POLICY_JSON alpine
|
|
||||||
+ ctr="$output"
|
|
||||||
+
|
|
||||||
+ # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
|
|
||||||
+ run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
|
|
||||||
+ # gid 1000 must be in additional/supplemental groups
|
|
||||||
+ expect_output --substring "Groups: 1000 "
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
@test "run --workingdir" {
|
|
||||||
skip_if_no_runtime
|
|
||||||
|
|
@ -4,6 +4,8 @@ Mon Sep 12 09:57:27 UTC 2022 - dcermak@suse.com
|
|||||||
- Update to version 1.27.1:
|
- Update to version 1.27.1:
|
||||||
* release: bump to v1.27.1
|
* release: bump to v1.27.1
|
||||||
* run: add container gid to additional groups
|
* run: add container gid to additional groups
|
||||||
|
- Drop add-container-gid-to-additional-groups.patch
|
||||||
|
(merged upstream)
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Aug 26 12:13:12 UTC 2022 - Dan Čermák <dcermak@suse.com>
|
Fri Aug 26 12:13:12 UTC 2022 - Dan Čermák <dcermak@suse.com>
|
||||||
|
@ -26,7 +26,6 @@ Group: System/Management
|
|||||||
URL: https://%{project}
|
URL: https://%{project}
|
||||||
Source0: %{name}-%{version}.tar.xz
|
Source0: %{name}-%{version}.tar.xz
|
||||||
Source1: %{name}-rpmlintrc
|
Source1: %{name}-rpmlintrc
|
||||||
Patch0: https://github.com/containers/buildah/commit/f0b2d39b83cd3bae8a6d0ef8c05fd384f81412a0.patch#./add-container-gid-to-additional-groups.patch
|
|
||||||
BuildRequires: bash-completion
|
BuildRequires: bash-completion
|
||||||
BuildRequires: device-mapper-devel
|
BuildRequires: device-mapper-devel
|
||||||
BuildRequires: fdupes
|
BuildRequires: fdupes
|
||||||
|
Loading…
x
Reference in New Issue
Block a user