github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-17 11:28:58 +00:00
Code Issues Projects Releases Wiki Activity

bug: Fix link file ownership of projected serviceAccountToken

Browse Source 
Signed-off-by: Gavin Lam <gavin.oss@tutamail.com>
This commit is contained in:
Gavin Lam
2026-03-01 14:25:30 -05:00
parent dbe44e3584
commit e5920df4da
3 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/volume/util/atomic_writer.go
View File

@@ -445,7 +445,7 @@ func (w *AtomicWriter) writePayloadToDir(payload map[string]FileProjection, dir
continue
}
if err := w.chown(fullPath, int(*fileProjection.FsUser), -1); err != nil {
if err := w.lchown(fullPath, int(*fileProjection.FsUser), -1); err != nil {
klog.Errorf("%s: unable to change file %s with owner %v: %v", w.logContext, fullPath, int(*fileProjection.FsUser), err)
return err
}
@@ -465,7 +465,7 @@ func (w *AtomicWriter) writePayloadToDir(payload map[string]FileProjection, dir
// foo -> ..data/foo
// baz -> ..data/baz
func (w *AtomicWriter) createUserVisibleFiles(payload map[string]FileProjection) error {
for userVisiblePath := range payload {
for userVisiblePath, fileProjection := range payload {
slashpos := strings.Index(userVisiblePath, string(os.PathSeparator))
if slashpos == -1 {
slashpos = len(userVisiblePath)
@@ -481,6 +481,15 @@ func (w *AtomicWriter) createUserVisibleFiles(payload map[string]FileProjection)
if err != nil {
return err
}
if fileProjection.FsUser == nil {
continue
}
if err := w.lchown(visibleFile, int(*fileProjection.FsUser), -1); err != nil {
klog.Errorf("%s: unable to change file %s with owner %v: %v", w.logContext, visibleFile, int(*fileProjection.FsUser), err)
return err
}
}
}
return nil

7
pkg/volume/util/atomic_writer_linux.go
View File

@@ -20,7 +20,8 @@ package util
import "os"
// chown changes the numeric uid and gid of the named file.
func (w *AtomicWriter) chown(name string, uid, gid int) error {
return os.Chown(name, uid, gid)
// lchown changes the numeric uid and gid of the named file.
// If the file is a symbolic link, it changes the uid and gid of the link itself.
func (w *AtomicWriter) lchown(name string, uid, gid int) error {
return os.Lchown(name, uid, gid)
}

5
pkg/volume/util/atomic_writer_unsupported.go
View File

@@ -24,9 +24,10 @@ import (
"k8s.io/klog/v2"
)
// chown changes the numeric uid and gid of the named file.
// lchown changes the numeric uid and gid of the named file.
// If the file is a symbolic link, it changes the uid and gid of the link itself.
// This is a no-op on unsupported platforms.
func (w *AtomicWriter) chown(name string, uid, _ /* gid */ int) error {
func (w *AtomicWriter) lchown(name string, uid, _ /* gid */ int) error {
klog.Warningf("%s: skipping change of Linux owner %v for file %s; unsupported on %s", w.logContext, uid, name, runtime.GOOS)
return nil
}