MSVSphere Packaging Team
1 year ago
parent
4369ef06ac
commit
6f7eaae58d
@ -1 +1 @@
|
||||
SOURCES/toolbox-0.0.99.3-vendored.tar.xz
|
||||
SOURCES/toolbox-0.0.99.4-vendored.tar.xz
|
||||
|
||||
@ -1 +1 @@
|
||||
ae6e6ac18c0d350eeabe9392a37ddc70cd60b52f SOURCES/toolbox-0.0.99.3-vendored.tar.xz
|
||||
3a2506e53c44cab54d476ee38af7197175e8af10 SOURCES/toolbox-0.0.99.4-vendored.tar.xz
|
||||
|
||||
@ -0,0 +1,89 @@
|
||||
From fc5f568c5d82f4a16982268fa67092e52be91fbe Mon Sep 17 00:00:00 2001
|
||||
From: Debarshi Ray <rishi@fedoraproject.org>
|
||||
Date: Tue, 28 Feb 2023 17:12:04 +0100
|
||||
Subject: [PATCH] cmd/root: Don't use podman(1) when generating the completions
|
||||
|
||||
Ever since commit bafbbe81c9220cb3, the shell completions are generated
|
||||
while building Toolbx using the 'completion' command. This involves
|
||||
running toolbox(1) itself, and hence invoking 'podman version' to decide
|
||||
if 'podman system migrate' is needed or not.
|
||||
|
||||
Unfortunately, some build environments, like Fedora's, are set up inside
|
||||
a chroot(2) or systemd-nspawn(1) or similar, where 'podman version' may
|
||||
not work because it does various things with namespaces(7) and clone(2)
|
||||
that can, under certain circumstances, encounter an EPERM.
|
||||
|
||||
Therefore, it's better to avoid using podman(1) when generating the
|
||||
shell completions, especially, since they are generated by Cobra itself
|
||||
and podman(1) is not involved at all.
|
||||
|
||||
Note that podman(1) is needed when the generated shell completions are
|
||||
actually used in interactive command line environments. The shell
|
||||
completions invoke the hidden '__complete' command to get the results
|
||||
that are presented to the user, and, if needed, 'podman system migrate'
|
||||
will continue to be run as part of that.
|
||||
|
||||
This partially reverts commit f3e005d0142d7ec76d5ac8f0a2f331a52fd46011
|
||||
because podman(1) is now only an optional runtime dependency for the
|
||||
system tests.
|
||||
|
||||
https://github.com/containers/podman/issues/17657
|
||||
---
|
||||
meson.build | 2 +-
|
||||
src/cmd/root.go | 9 +++++++--
|
||||
2 files changed, 8 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/meson.build b/meson.build
|
||||
index 6f044bb204e3..653a3d3ac588 100644
|
||||
--- a/meson.build
|
||||
+++ b/meson.build
|
||||
@@ -18,12 +18,12 @@ subid_dep = cc.find_library('subid', has_headers: ['shadow/subid.h'])
|
||||
|
||||
go = find_program('go')
|
||||
go_md2man = find_program('go-md2man')
|
||||
-podman = find_program('podman')
|
||||
|
||||
bats = find_program('bats', required: false)
|
||||
codespell = find_program('codespell', required: false)
|
||||
htpasswd = find_program('htpasswd', required: false)
|
||||
openssl = find_program('openssl', required: false)
|
||||
+podman = find_program('podman', required: false)
|
||||
shellcheck = find_program('shellcheck', required: false)
|
||||
skopeo = find_program('skopeo', required: false)
|
||||
|
||||
diff --git a/src/cmd/root.go b/src/cmd/root.go
|
||||
index 304b03dcd889..9975ccc7a4c8 100644
|
||||
--- a/src/cmd/root.go
|
||||
+++ b/src/cmd/root.go
|
||||
@@ -166,7 +166,7 @@ func preRun(cmd *cobra.Command, args []string) error {
|
||||
|
||||
logrus.Debugf("TOOLBOX_PATH is %s", toolboxPath)
|
||||
|
||||
- if err := migrate(); err != nil {
|
||||
+ if err := migrate(cmd, args); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -211,13 +211,18 @@ func rootRun(cmd *cobra.Command, args []string) error {
|
||||
return rootRunImpl(cmd, args)
|
||||
}
|
||||
|
||||
-func migrate() error {
|
||||
+func migrate(cmd *cobra.Command, args []string) error {
|
||||
logrus.Debug("Migrating to newer Podman")
|
||||
|
||||
if utils.IsInsideContainer() {
|
||||
return nil
|
||||
}
|
||||
|
||||
+ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName {
|
||||
+ logrus.Debugf("Migration not needed: command %s doesn't need it", cmdName)
|
||||
+ return nil
|
||||
+ }
|
||||
+
|
||||
configDir, err := os.UserConfigDir()
|
||||
if err != nil {
|
||||
logrus.Debugf("Migrating to newer Podman: failed to get the user config directory: %s", err)
|
||||
--
|
||||
2.39.1
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,76 @@
|
||||
From 1cc9e07b7c36fe9f9784b40b58f0a2a3694dd328 Mon Sep 17 00:00:00 2001
|
||||
From: Debarshi Ray <rishi@fedoraproject.org>
|
||||
Date: Thu, 13 Jul 2023 13:08:40 +0200
|
||||
Subject: [PATCH] cmd/initContainer: Be aware of security hardened mount points
|
||||
|
||||
Sometimes locations such as /var/lib/flatpak, /var/lib/systemd/coredump
|
||||
and /var/log/journal sit on security hardened mount points that are
|
||||
marked as 'nosuid,nodev,noexec' [1]. In such cases, when Toolbx is used
|
||||
rootless, an attempt to bind mount these locations read-only at runtime
|
||||
with mount(8) fails because of permission problems:
|
||||
# mount --rbind -o ro <source> <containerPath>
|
||||
mount: <containerPath>: filesystem was mounted, but any subsequent
|
||||
operation failed: Unknown error 5005.
|
||||
|
||||
(Note that the above error message from mount(8) was subsequently
|
||||
improved to show something more meaningful than 'Unknown error' [2].)
|
||||
|
||||
The problem is that 'init-container' is running inside the container's
|
||||
mount and user namespace, and the source paths were mounted inside the
|
||||
host's namespace with 'nosuid,nodev,noexec'. The above mount(8) call
|
||||
tries to remove the 'nosuid,nodev,noexec' flags from the mount point and
|
||||
replace them with only 'ro', which is something that can't be done from
|
||||
a child namespace.
|
||||
|
||||
Note that this doesn't fail when Toolbx is running as root. This is
|
||||
because the container uses the host's user namespace and is able to
|
||||
remove the 'nosuid,nodev,noexec' flags from the mount point and replace
|
||||
them with only 'ro'. Even though it doesn't fail, the flags shouldn't
|
||||
get replaced like that inside the container, because it removes the
|
||||
security hardening of those mount points.
|
||||
|
||||
There's actually no benefit in bind mounting these paths as read-only.
|
||||
It was historically done this way 'just to be safe' because a user isn't
|
||||
expected to write to these locations from inside a container. However,
|
||||
Toolbx doesn't intend to provide any heightened security beyond what's
|
||||
already available on the host.
|
||||
|
||||
Hence, it's better to get out of the way and leave it to the permissions
|
||||
on the source location from the host operating system to guard the
|
||||
castle. This is accomplished by not passing any file system options to
|
||||
mount(8) [1].
|
||||
|
||||
Based on an idea from Si.
|
||||
|
||||
[1] https://man7.org/linux/man-pages/man8/mount.8.html
|
||||
|
||||
[2] util-linux commit 9420ca34dc8b6f0f
|
||||
https://github.com/util-linux/util-linux/commit/9420ca34dc8b6f0f
|
||||
https://github.com/util-linux/util-linux/pull/2376
|
||||
|
||||
https://github.com/containers/toolbox/issues/911
|
||||
---
|
||||
src/cmd/initContainer.go | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go
|
||||
index 222aa42e1036..41b825b33f58 100644
|
||||
--- a/src/cmd/initContainer.go
|
||||
+++ b/src/cmd/initContainer.go
|
||||
@@ -62,10 +62,10 @@ var (
|
||||
{"/run/udev/data", "/run/host/run/udev/data", ""},
|
||||
{"/run/udev/tags", "/run/host/run/udev/tags", ""},
|
||||
{"/tmp", "/run/host/tmp", "rslave"},
|
||||
- {"/var/lib/flatpak", "/run/host/var/lib/flatpak", "ro"},
|
||||
+ {"/var/lib/flatpak", "/run/host/var/lib/flatpak", ""},
|
||||
{"/var/lib/libvirt", "/run/host/var/lib/libvirt", ""},
|
||||
- {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", "ro"},
|
||||
- {"/var/log/journal", "/run/host/var/log/journal", "ro"},
|
||||
+ {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", ""},
|
||||
+ {"/var/log/journal", "/run/host/var/log/journal", ""},
|
||||
{"/var/mnt", "/run/host/var/mnt", "rslave"},
|
||||
}
|
||||
)
|
||||
--
|
||||
2.41.0
|
||||
|
||||
Loading…
Reference in new issue