From e5920df4dae91e6548108a572d6efe9c1e7a0bf4 Mon Sep 17 00:00:00 2001 From: Gavin Lam Date: Sun, 1 Mar 2026 14:25:30 -0500 Subject: [PATCH] bug: Fix link file ownership of projected serviceAccountToken Signed-off-by: Gavin Lam --- pkg/volume/util/atomic_writer.go | 13 +++++++++++-- pkg/volume/util/atomic_writer_linux.go | 7 ++++--- pkg/volume/util/atomic_writer_unsupported.go | 5 +++-- 3 files changed, 18 insertions(+), 7 deletions(-) diff --git a/pkg/volume/util/atomic_writer.go b/pkg/volume/util/atomic_writer.go index 0466dffacdf..cd61baabc16 100644 --- a/pkg/volume/util/atomic_writer.go +++ b/pkg/volume/util/atomic_writer.go @@ -445,7 +445,7 @@ func (w *AtomicWriter) writePayloadToDir(payload map[string]FileProjection, dir continue } - if err := w.chown(fullPath, int(*fileProjection.FsUser), -1); err != nil { + if err := w.lchown(fullPath, int(*fileProjection.FsUser), -1); err != nil { klog.Errorf("%s: unable to change file %s with owner %v: %v", w.logContext, fullPath, int(*fileProjection.FsUser), err) return err } @@ -465,7 +465,7 @@ func (w *AtomicWriter) writePayloadToDir(payload map[string]FileProjection, dir // foo -> ..data/foo // baz -> ..data/baz func (w *AtomicWriter) createUserVisibleFiles(payload map[string]FileProjection) error { - for userVisiblePath := range payload { + for userVisiblePath, fileProjection := range payload { slashpos := strings.Index(userVisiblePath, string(os.PathSeparator)) if slashpos == -1 { slashpos = len(userVisiblePath) @@ -481,6 +481,15 @@ func (w *AtomicWriter) createUserVisibleFiles(payload map[string]FileProjection) if err != nil { return err } + + if fileProjection.FsUser == nil { + continue + } + + if err := w.lchown(visibleFile, int(*fileProjection.FsUser), -1); err != nil { + klog.Errorf("%s: unable to change file %s with owner %v: %v", w.logContext, visibleFile, int(*fileProjection.FsUser), err) + return err + } } } return nil diff --git a/pkg/volume/util/atomic_writer_linux.go b/pkg/volume/util/atomic_writer_linux.go index 15f4cd77403..ba3b64c55cc 100644 --- a/pkg/volume/util/atomic_writer_linux.go +++ b/pkg/volume/util/atomic_writer_linux.go @@ -20,7 +20,8 @@ package util import "os" -// chown changes the numeric uid and gid of the named file. -func (w *AtomicWriter) chown(name string, uid, gid int) error { - return os.Chown(name, uid, gid) +// lchown changes the numeric uid and gid of the named file. +// If the file is a symbolic link, it changes the uid and gid of the link itself. +func (w *AtomicWriter) lchown(name string, uid, gid int) error { + return os.Lchown(name, uid, gid) } diff --git a/pkg/volume/util/atomic_writer_unsupported.go b/pkg/volume/util/atomic_writer_unsupported.go index 2a5ec11a138..a77ef9414e9 100644 --- a/pkg/volume/util/atomic_writer_unsupported.go +++ b/pkg/volume/util/atomic_writer_unsupported.go @@ -24,9 +24,10 @@ import ( "k8s.io/klog/v2" ) -// chown changes the numeric uid and gid of the named file. +// lchown changes the numeric uid and gid of the named file. +// If the file is a symbolic link, it changes the uid and gid of the link itself. // This is a no-op on unsupported platforms. -func (w *AtomicWriter) chown(name string, uid, _ /* gid */ int) error { +func (w *AtomicWriter) lchown(name string, uid, _ /* gid */ int) error { klog.Warningf("%s: skipping change of Linux owner %v for file %s; unsupported on %s", w.logContext, uid, name, runtime.GOOS) return nil }