beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

oci: correctly use user.GetExecUser interface

Browse source 
A nil interface in Go is not the same as a nil pointer that satisfies
the interface. libcontainer/user has special handling for missing
/etc/{passwd,group} files but this is all based on nil interface checks,
which were broken by Docker's usage of the API.

When combined with some recent changes in runc that made read errors
actually be returned to the caller, this results in spurrious -EINVAL
errors when we should detect the situation as "there is no passwd file".

Signed-off-by: Aleksa Sarai <asarai@suse.de>
This commit is contained in:
Aleksa Sarai 2020-07-29 12:43:43 +10:00 committed by Sebastiaan van Stijn
parent 516d9719d5
commit 3108ae6226
No known key found for this signature in database
GPG key ID: 76698F39D527CE8C
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
daemon/oci_linux.go
View file

@ -176,7 +176,14 @@ func readUserFile(c *container.Container, p string) (io.ReadCloser, error) {
if err != nil {
return nil, err
}
return os.Open(fp)
fh, err := os.Open(fp)
if err != nil {
// This is needed because a nil *os.File is different to a nil
// io.ReadCloser and this causes GetExecUser to not detect that the
// container file is missing.
return nil, err
}
return fh, nil
}
func getUser(c *container.Container, username string) (uint32, uint32, []uint32, error) {