Skip to content

Commit

Permalink
Merge pull request containers#15895 from dcermak/don-expose-dev-for-p…
Browse files Browse the repository at this point in the history
…rivileged

Don't mount /dev/ inside privileged containers running systemd
  • Loading branch information
openshift-merge-robot authored Sep 22, 2022
2 parents 8bf3535 + 5a2405a commit 0899351
Show file tree
Hide file tree
Showing 4 changed files with 28 additions and 3 deletions.
6 changes: 5 additions & 1 deletion libpod/container_internal_common.go
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,11 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
// If the flag to mount all devices is set for a privileged container, add
// all the devices from the host's machine into the container
if c.config.MountAllDevices {
if err := util.AddPrivilegedDevices(&g); err != nil {
systemdMode := false
if c.config.Systemd != nil {
systemdMode = *c.config.Systemd
}
if err := util.AddPrivilegedDevices(&g, systemdMode); err != nil {
return nil, err
}
}
Expand Down
2 changes: 1 addition & 1 deletion pkg/util/utils_freebsd.go
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,6 @@ func GetContainerPidInformationDescriptors() ([]string, error) {
return []string{}, errors.New("this function is not supported on freebsd")
}

func AddPrivilegedDevices(g *generate.Generator) error {
func AddPrivilegedDevices(g *generate.Generator, systemdMode bool) error {
return nil
}
5 changes: 4 additions & 1 deletion pkg/util/utils_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ func FindDeviceNodes() (map[string]string, error) {
return nodes, nil
}

func AddPrivilegedDevices(g *generate.Generator) error {
func AddPrivilegedDevices(g *generate.Generator, systemdMode bool) error {
hostDevices, err := getDevices("/dev")
if err != nil {
return err
Expand Down Expand Up @@ -104,6 +104,9 @@ func AddPrivilegedDevices(g *generate.Generator) error {
}
} else {
for _, d := range hostDevices {
if systemdMode && strings.HasPrefix(d.Path, "/dev/tty") {
continue
}
g.AddDevice(d)
}
// Add resources device - need to clear the existing one first.
Expand Down
18 changes: 18 additions & 0 deletions test/system/030-run.bats
Original file line number Diff line number Diff line change
Expand Up @@ -901,4 +901,22 @@ $IMAGE--c_ok" \
run_podman rm $ctr_name
}

@test "podman run --privileged as root with systemd will not mount /dev/tty" {
skip_if_rootless "this test only makes sense as root"

ctr_name="container-$(random_string 5)"
run_podman run --rm -d --privileged --systemd=always --name "$ctr_name" "$IMAGE" /home/podman/pause

TTYs=$(ls /dev/tty*|sed '/^\/dev\/tty$/d')

if [[ $TTYs = "" ]]; then
die "Did not find any /dev/ttyN devices on local host"
else
run_podman exec "$ctr_name" ls /dev/
assert "$(grep tty <<<$output)" = "tty" "There must be no /dev/ttyN devices in the container"
fi

run_podman stop "$ctr_name"
}

# vim: filetype=sh

0 comments on commit 0899351

Please sign in to comment.