i8c-stream-4.0
changed/i8c-stream-4.0/toolbox-0.0.99.4-5.module+el8.9.0+19656+a0b7daeb
MSVSphere Packaging Team
1 year ago
parent
e9c76eebca
commit
da75ca49bf
@ -1 +1 @@
|
|||||||
SOURCES/toolbox-0.0.99.3-vendored.tar.xz
|
SOURCES/toolbox-0.0.99.4-vendored.tar.xz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
ae6e6ac18c0d350eeabe9392a37ddc70cd60b52f SOURCES/toolbox-0.0.99.3-vendored.tar.xz
|
3a2506e53c44cab54d476ee38af7197175e8af10 SOURCES/toolbox-0.0.99.4-vendored.tar.xz
|
||||||
|
|||||||
@ -0,0 +1,89 @@
|
|||||||
|
From fc5f568c5d82f4a16982268fa67092e52be91fbe Mon Sep 17 00:00:00 2001
|
||||||
|
From: Debarshi Ray <rishi@fedoraproject.org>
|
||||||
|
Date: Tue, 28 Feb 2023 17:12:04 +0100
|
||||||
|
Subject: [PATCH] cmd/root: Don't use podman(1) when generating the completions
|
||||||
|
|
||||||
|
Ever since commit bafbbe81c9220cb3, the shell completions are generated
|
||||||
|
while building Toolbx using the 'completion' command. This involves
|
||||||
|
running toolbox(1) itself, and hence invoking 'podman version' to decide
|
||||||
|
if 'podman system migrate' is needed or not.
|
||||||
|
|
||||||
|
Unfortunately, some build environments, like Fedora's, are set up inside
|
||||||
|
a chroot(2) or systemd-nspawn(1) or similar, where 'podman version' may
|
||||||
|
not work because it does various things with namespaces(7) and clone(2)
|
||||||
|
that can, under certain circumstances, encounter an EPERM.
|
||||||
|
|
||||||
|
Therefore, it's better to avoid using podman(1) when generating the
|
||||||
|
shell completions, especially, since they are generated by Cobra itself
|
||||||
|
and podman(1) is not involved at all.
|
||||||
|
|
||||||
|
Note that podman(1) is needed when the generated shell completions are
|
||||||
|
actually used in interactive command line environments. The shell
|
||||||
|
completions invoke the hidden '__complete' command to get the results
|
||||||
|
that are presented to the user, and, if needed, 'podman system migrate'
|
||||||
|
will continue to be run as part of that.
|
||||||
|
|
||||||
|
This partially reverts commit f3e005d0142d7ec76d5ac8f0a2f331a52fd46011
|
||||||
|
because podman(1) is now only an optional runtime dependency for the
|
||||||
|
system tests.
|
||||||
|
|
||||||
|
https://github.com/containers/podman/issues/17657
|
||||||
|
---
|
||||||
|
meson.build | 2 +-
|
||||||
|
src/cmd/root.go | 9 +++++++--
|
||||||
|
2 files changed, 8 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/meson.build b/meson.build
|
||||||
|
index 6f044bb204e3..653a3d3ac588 100644
|
||||||
|
--- a/meson.build
|
||||||
|
+++ b/meson.build
|
||||||
|
@@ -18,12 +18,12 @@ subid_dep = cc.find_library('subid', has_headers: ['shadow/subid.h'])
|
||||||
|
|
||||||
|
go = find_program('go')
|
||||||
|
go_md2man = find_program('go-md2man')
|
||||||
|
-podman = find_program('podman')
|
||||||
|
|
||||||
|
bats = find_program('bats', required: false)
|
||||||
|
codespell = find_program('codespell', required: false)
|
||||||
|
htpasswd = find_program('htpasswd', required: false)
|
||||||
|
openssl = find_program('openssl', required: false)
|
||||||
|
+podman = find_program('podman', required: false)
|
||||||
|
shellcheck = find_program('shellcheck', required: false)
|
||||||
|
skopeo = find_program('skopeo', required: false)
|
||||||
|
|
||||||
|
diff --git a/src/cmd/root.go b/src/cmd/root.go
|
||||||
|
index 304b03dcd889..9975ccc7a4c8 100644
|
||||||
|
--- a/src/cmd/root.go
|
||||||
|
+++ b/src/cmd/root.go
|
||||||
|
@@ -166,7 +166,7 @@ func preRun(cmd *cobra.Command, args []string) error {
|
||||||
|
|
||||||
|
logrus.Debugf("TOOLBOX_PATH is %s", toolboxPath)
|
||||||
|
|
||||||
|
- if err := migrate(); err != nil {
|
||||||
|
+ if err := migrate(cmd, args); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -211,13 +211,18 @@ func rootRun(cmd *cobra.Command, args []string) error {
|
||||||
|
return rootRunImpl(cmd, args)
|
||||||
|
}
|
||||||
|
|
||||||
|
-func migrate() error {
|
||||||
|
+func migrate(cmd *cobra.Command, args []string) error {
|
||||||
|
logrus.Debug("Migrating to newer Podman")
|
||||||
|
|
||||||
|
if utils.IsInsideContainer() {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName {
|
||||||
|
+ logrus.Debugf("Migration not needed: command %s doesn't need it", cmdName)
|
||||||
|
+ return nil
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
configDir, err := os.UserConfigDir()
|
||||||
|
if err != nil {
|
||||||
|
logrus.Debugf("Migrating to newer Podman: failed to get the user config directory: %s", err)
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,76 @@
|
|||||||
|
From 1cc9e07b7c36fe9f9784b40b58f0a2a3694dd328 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Debarshi Ray <rishi@fedoraproject.org>
|
||||||
|
Date: Thu, 13 Jul 2023 13:08:40 +0200
|
||||||
|
Subject: [PATCH] cmd/initContainer: Be aware of security hardened mount points
|
||||||
|
|
||||||
|
Sometimes locations such as /var/lib/flatpak, /var/lib/systemd/coredump
|
||||||
|
and /var/log/journal sit on security hardened mount points that are
|
||||||
|
marked as 'nosuid,nodev,noexec' [1]. In such cases, when Toolbx is used
|
||||||
|
rootless, an attempt to bind mount these locations read-only at runtime
|
||||||
|
with mount(8) fails because of permission problems:
|
||||||
|
# mount --rbind -o ro <source> <containerPath>
|
||||||
|
mount: <containerPath>: filesystem was mounted, but any subsequent
|
||||||
|
operation failed: Unknown error 5005.
|
||||||
|
|
||||||
|
(Note that the above error message from mount(8) was subsequently
|
||||||
|
improved to show something more meaningful than 'Unknown error' [2].)
|
||||||
|
|
||||||
|
The problem is that 'init-container' is running inside the container's
|
||||||
|
mount and user namespace, and the source paths were mounted inside the
|
||||||
|
host's namespace with 'nosuid,nodev,noexec'. The above mount(8) call
|
||||||
|
tries to remove the 'nosuid,nodev,noexec' flags from the mount point and
|
||||||
|
replace them with only 'ro', which is something that can't be done from
|
||||||
|
a child namespace.
|
||||||
|
|
||||||
|
Note that this doesn't fail when Toolbx is running as root. This is
|
||||||
|
because the container uses the host's user namespace and is able to
|
||||||
|
remove the 'nosuid,nodev,noexec' flags from the mount point and replace
|
||||||
|
them with only 'ro'. Even though it doesn't fail, the flags shouldn't
|
||||||
|
get replaced like that inside the container, because it removes the
|
||||||
|
security hardening of those mount points.
|
||||||
|
|
||||||
|
There's actually no benefit in bind mounting these paths as read-only.
|
||||||
|
It was historically done this way 'just to be safe' because a user isn't
|
||||||
|
expected to write to these locations from inside a container. However,
|
||||||
|
Toolbx doesn't intend to provide any heightened security beyond what's
|
||||||
|
already available on the host.
|
||||||
|
|
||||||
|
Hence, it's better to get out of the way and leave it to the permissions
|
||||||
|
on the source location from the host operating system to guard the
|
||||||
|
castle. This is accomplished by not passing any file system options to
|
||||||
|
mount(8) [1].
|
||||||
|
|
||||||
|
Based on an idea from Si.
|
||||||
|
|
||||||
|
[1] https://man7.org/linux/man-pages/man8/mount.8.html
|
||||||
|
|
||||||
|
[2] util-linux commit 9420ca34dc8b6f0f
|
||||||
|
https://github.com/util-linux/util-linux/commit/9420ca34dc8b6f0f
|
||||||
|
https://github.com/util-linux/util-linux/pull/2376
|
||||||
|
|
||||||
|
https://github.com/containers/toolbox/issues/911
|
||||||
|
---
|
||||||
|
src/cmd/initContainer.go | 6 +++---
|
||||||
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go
|
||||||
|
index 222aa42e1036..41b825b33f58 100644
|
||||||
|
--- a/src/cmd/initContainer.go
|
||||||
|
+++ b/src/cmd/initContainer.go
|
||||||
|
@@ -62,10 +62,10 @@ var (
|
||||||
|
{"/run/udev/data", "/run/host/run/udev/data", ""},
|
||||||
|
{"/run/udev/tags", "/run/host/run/udev/tags", ""},
|
||||||
|
{"/tmp", "/run/host/tmp", "rslave"},
|
||||||
|
- {"/var/lib/flatpak", "/run/host/var/lib/flatpak", "ro"},
|
||||||
|
+ {"/var/lib/flatpak", "/run/host/var/lib/flatpak", ""},
|
||||||
|
{"/var/lib/libvirt", "/run/host/var/lib/libvirt", ""},
|
||||||
|
- {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", "ro"},
|
||||||
|
- {"/var/log/journal", "/run/host/var/log/journal", "ro"},
|
||||||
|
+ {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", ""},
|
||||||
|
+ {"/var/log/journal", "/run/host/var/log/journal", ""},
|
||||||
|
{"/var/mnt", "/run/host/var/mnt", "rslave"},
|
||||||
|
}
|
||||||
|
)
|
||||||
|
--
|
||||||
|
2.41.0
|
||||||
|
|
||||||
Loading…
Reference in new issue