github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-07-12 14:48:13 +00:00
Code Issues Projects Releases Wiki Activity

obs-packaging: install images as read-only files

Browse Source 
In order to improve the security of Kata, nothing should be able to modify
the images. It would be really bad if a malicious container or process
modified them.

fixes #631

Signed-off-by: Julio Montes <julio.montes@intel.com>
This commit is contained in:
Julio Montes 2019-07-10 14:01:18 +00:00
parent 3df25f25b7
commit 54f37864f6
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
obs-packaging/kata-containers-image/debian.rules-template
View File

@ -9,8 +9,8 @@ override_dh_auto_install:
tar xzf /usr/src/packages/SOURCES/kata-containers.tar.gz -C /usr/src/packages/SOURCES/ ; \
image=$$(find /usr/src/packages/SOURCES/ -type f -name '*.img') ; \
initrd=$$(find /usr/src/packages/SOURCES/ -type f -name '*.initrd') ; \
install -D $${image} ./debian/kata-containers-image/usr/share/kata-containers/ ; \
install -D $${initrd} ./debian/kata-containers-image/usr/share/kata-containers/ ; \
install -m 0400 -D $${image} ./debian/kata-containers-image/usr/share/kata-containers/ ; \
install -m 0400 -D $${initrd} ./debian/kata-containers-image/usr/share/kata-containers/ ; \
ln -s /usr/share/kata-containers/$$(basename $${image}) \
./debian/kata-containers-image/usr/share/kata-containers/kata-containers.img ; \
ln -s /usr/share/kata-containers/$$(basename $${initrd}) \

4
obs-packaging/kata-containers-image/kata-containers-image.spec-template
View File

@ -28,8 +28,8 @@ tar xfz kata-containers.tar.gz
image=$(find ${PWD} -type f -name '*.img')
initrd=$(find ${PWD} -type f -name '*.initrd')
popd
install -p "${image}" ${ImageDir}/
install -p "${initrd}" ${ImageDir}/
install -m 0400 -p "${image}" ${ImageDir}/
install -m 0400 -p "${initrd}" ${ImageDir}/
ln -s /usr/share/kata-containers/$(basename "${image}") ${ImageDir}/kata-containers.img
ln -s /usr/share/kata-containers/$(basename "${initrd}") ${ImageDir}/kata-containers-initrd.img