github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-09-20 08:18:24 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #8836 from microsoft/danmihai1/test-with-cbl-mariner

Browse Source 
genpolicy: use root path from cbl-mariner Guest VM
This commit is contained in:
Fabiano Fidêncio
2024-01-17 17:51:44 +01:00
committed by GitHub
parent e11c520ffa f4106a6107
commit 147d5fd752
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/tools/genpolicy/genpolicy-settings.json
View File

@@ -1,7 +1,7 @@
{ {
"pause_container": { "pause_container": {
"Root": { "Root": {
"Path": "$(cpath)/$(bundle-id)", "Path": "$(cpath)/$(bundle-id)/rootfs",
"Readonly": true "Readonly": true
}, },
"Mounts": [ "Mounts": [
@@ -62,7 +62,7 @@
}, },
"other_container": { "other_container": {
"Root": { "Root": {
"Path": "$(cpath)/$(bundle-id)" "Path": "$(cpath)/$(bundle-id)/rootfs"
}, },
"Mounts": [ "Mounts": [
{ {

5
src/tools/genpolicy/rules.rego
View File

@@ -701,8 +701,9 @@ is_ip_other_byte(component) {
# OCI root.Path # OCI root.Path
allow_root_path(p_oci, i_oci, bundle_id) { allow_root_path(p_oci, i_oci, bundle_id) {
i_path := i_oci.Root.Path
p_path1 := p_oci.Root.Path p_path1 := p_oci.Root.Path
print("allow_root_path: p_path1 =", p_path1) print("allow_root_path: i_path =", i_path, "p_path1 =", p_path1)
p_path2 := replace(p_path1, "$(cpath)", policy_data.common.cpath) p_path2 := replace(p_path1, "$(cpath)", policy_data.common.cpath)
print("allow_root_path: p_path2 =", p_path2) print("allow_root_path: p_path2 =", p_path2)
@@ -710,7 +711,7 @@ allow_root_path(p_oci, i_oci, bundle_id) {
p_path3 := replace(p_path2, "$(bundle-id)", bundle_id) p_path3 := replace(p_path2, "$(bundle-id)", bundle_id)
print("allow_root_path: p_path3 =", p_path3) print("allow_root_path: p_path3 =", p_path3)
p_path3 == i_oci.Root.Path p_path3 == i_path
print("allow_root_path: true") print("allow_root_path: true")
} }