90 lines
2.9 KiB
Diff
90 lines
2.9 KiB
Diff
From a9c5cbc1e66e6ac8e5fc6749755c1b40690ffc23 Mon Sep 17 00:00:00 2001
|
|
From: Jianmin <jianmin@iscas.ac.cn>
|
|
Date: Wed, 25 Dec 2024 12:49:25 +0800
|
|
Subject: [PATCH] [backport][PATCH] run: add container gid to additional groups
|
|
|
|
---
|
|
run_linux.go | 1 +
|
|
tests/bud.bats | 16 ++++++++++++++++
|
|
tests/bud/supplemental-groups/Dockerfile | 3 +++
|
|
tests/run.bats | 14 ++++++++++++++
|
|
4 files changed, 34 insertions(+)
|
|
create mode 100644 tests/bud/supplemental-groups/Dockerfile
|
|
|
|
diff --git a/run_linux.go b/run_linux.go
|
|
index f52754c..7a61a9a 100644
|
|
--- a/run_linux.go
|
|
+++ b/run_linux.go
|
|
@@ -2063,6 +2063,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
|
|
}
|
|
g.SetProcessUID(user.UID)
|
|
g.SetProcessGID(user.GID)
|
|
+ g.AddProcessAdditionalGid(user.GID)
|
|
for _, gid := range user.AdditionalGids {
|
|
g.AddProcessAdditionalGid(gid)
|
|
}
|
|
diff --git a/tests/bud.bats b/tests/bud.bats
|
|
index f43a4a9..8d2ca2c 100644
|
|
--- a/tests/bud.bats
|
|
+++ b/tests/bud.bats
|
|
@@ -601,6 +601,22 @@ _EOF
|
|
expect_output "[]"
|
|
}
|
|
|
|
+@test "build test has gid in supplemental groups" {
|
|
+ _prefetch alpine
|
|
+ run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
|
|
+ # gid 1000 must be in supplemental groups
|
|
+ expect_output --substring "Groups: 1000"
|
|
+}
|
|
+
|
|
+@test "build test if supplemental groups has gid with --isolation chroot" {
|
|
+ test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
|
|
+
|
|
+ _prefetch alpine
|
|
+ run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
|
|
+ # gid 1000 must be in supplemental groups
|
|
+ expect_output --substring "Groups: 1000"
|
|
+}
|
|
+
|
|
@test "build with custom build output and output rootfs to directory" {
|
|
_prefetch alpine
|
|
mytmpdir=${TEST_SCRATCH_DIR}/my-dir
|
|
diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
|
|
new file mode 100644
|
|
index 0000000..462d9ea
|
|
--- /dev/null
|
|
+++ b/tests/bud/supplemental-groups/Dockerfile
|
|
@@ -0,0 +1,3 @@
|
|
+FROM alpine
|
|
+USER 1000:1000
|
|
+RUN cat /proc/$$/status
|
|
diff --git a/tests/run.bats b/tests/run.bats
|
|
index 6574337..6a7cadf 100644
|
|
--- a/tests/run.bats
|
|
+++ b/tests/run.bats
|
|
@@ -349,6 +349,20 @@ function configure_and_check_user() {
|
|
expect_output "888:888"
|
|
}
|
|
|
|
+@test "run --user and verify gid in supplemental groups" {
|
|
+ skip_if_no_runtime
|
|
+
|
|
+ # Create the container.
|
|
+ _prefetch alpine
|
|
+ run_buildah from $WITH_POLICY_JSON alpine
|
|
+ ctr="$output"
|
|
+
|
|
+ # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
|
|
+ run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
|
|
+ # gid 1000 must be in additional/supplemental groups
|
|
+ expect_output --substring "Groups: 1000 "
|
|
+}
|
|
+
|
|
@test "run --workingdir" {
|
|
skip_if_no_runtime
|
|
|
|
--
|
|
2.39.5 (Apple Git-154)
|
|
|