53 lines
1.7 KiB
Diff
53 lines
1.7 KiB
Diff
From db3b399a8d7dabf7f073db73894bee98311d7909 Mon Sep 17 00:00:00 2001
|
|
From: Peter Hunt~ <pehunt@redhat.com>
|
|
Date: Mon, 22 Aug 2022 15:10:05 -0400
|
|
Subject: [PATCH] server: add container GID to additional groups
|
|
|
|
Signed-off-by: Peter Hunt~ <pehunt@redhat.com>
|
|
---
|
|
server/container_create.go | 5 +++--
|
|
test/ctr.bats | 12 ++++++++++++
|
|
2 files changed, 15 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/server/container_create.go b/server/container_create.go
|
|
index 1acfa182133..80867de29fc 100644
|
|
--- a/server/container_create.go
|
|
+++ b/server/container_create.go
|
|
@@ -249,10 +249,11 @@ func setupContainerUser(ctx context.Context, specgen *generate.Generator, rootfs
|
|
}
|
|
|
|
specgen.SetProcessUID(uid)
|
|
- specgen.SetProcessGID(gid)
|
|
if sc.RunAsGroup != nil {
|
|
- specgen.SetProcessGID(uint32(sc.RunAsGroup.Value))
|
|
+ gid = uint32(sc.RunAsGroup.Value)
|
|
}
|
|
+ specgen.SetProcessGID(gid)
|
|
+ specgen.AddProcessAdditionalGid(gid)
|
|
|
|
for _, group := range addGroups {
|
|
specgen.AddProcessAdditionalGid(group)
|
|
diff --git a/test/ctr.bats b/test/ctr.bats
|
|
index 82fed4f883f..801f26c55db 100644
|
|
--- a/test/ctr.bats
|
|
+++ b/test/ctr.bats
|
|
@@ -885,6 +885,18 @@ function check_oci_annotation() {
|
|
crictl exec --sync "$ctr_id" grep "CapEff:\s0000000000000000" /proc/1/status
|
|
}
|
|
|
|
+@test "ctr has gid in supplimental groups" {
|
|
+ start_crio
|
|
+
|
|
+ jq ' .linux.security_context.run_as_user.value = 1000
|
|
+ | .linux.security_context.run_as_group.value = 1000' \
|
|
+ "$TESTDATA"/container_redis.json > "$newconfig"
|
|
+
|
|
+ ctr_id=$(crictl run "$newconfig" "$TESTDATA"/sandbox_config.json)
|
|
+
|
|
+ crictl exec --sync "$ctr_id" grep Groups:.1000 /proc/1/status
|
|
+}
|
|
+
|
|
@test "ctr with low memory configured should not be created" {
|
|
start_crio
|
|
pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)
|