github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-04-30 04:34:27 +00:00
Code Issues Projects Releases Wiki Activity

exec: ensure sup groups are added to agent request

Browse Source 
Extra groups were not being handled when exec'ing. Ensure
that these are handled.

Before this, running a pod with:
```
 ...snippet...
 securityContext:
   fsGroup: 266
   runAsGroup: 51020
   runAsUser: 264
```

And then exec'ing would not supply the fsGroup:
```
$ kubectl exec -it kata-bb  -- sh -c id
uid=264 gid=51020
```

Fixes: #1500

Signed-off-by: Eric Ernst <eric.g.ernst@gmail.com>
This commit is contained in:
Eric Ernst 2021-03-09 14:42:01 -05:00 committed by Eric Ernst
parent 9e90105092
commit f0d49851db
1 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/runtime/containerd-shim-v2/exec.go
View File

@ -90,6 +90,10 @@ func newExec(c *container, stdin, stdout, stderr string, terminal bool, jspec *g
height = uint32(spec.ConsoleSize.Height) height = uint32(spec.ConsoleSize.Height)
width = uint32(spec.ConsoleSize.Width) width = uint32(spec.ConsoleSize.Width)
} }
var extraGroups []string
for _, g := range spec.User.AdditionalGids {
extraGroups = append(extraGroups, fmt.Sprintf("%d", g))
}
tty := &tty{ tty := &tty{
stdin: stdin, stdin: stdin,
@ -101,14 +105,15 @@ func newExec(c *container, stdin, stdout, stderr string, terminal bool, jspec *g
} }
cmds := &types.Cmd{ cmds := &types.Cmd{
Args: spec.Args, Args: spec.Args,
Envs: getEnvs(spec.Env), Envs: getEnvs(spec.Env),
User: fmt.Sprintf("%d", spec.User.UID), User: fmt.Sprintf("%d", spec.User.UID),
PrimaryGroup: fmt.Sprintf("%d", spec.User.GID), PrimaryGroup: fmt.Sprintf("%d", spec.User.GID),
WorkDir: spec.Cwd, SupplementaryGroups: extraGroups,
Interactive: terminal, WorkDir: spec.Cwd,
Detach: !terminal, Interactive: terminal,
NoNewPrivileges: spec.NoNewPrivileges, Detach: !terminal,
NoNewPrivileges: spec.NoNewPrivileges,
} }
exec := &exec{ exec := &exec{