098a44c07f
Finish the refactor which was partially completed with commit
34536c498d, passing around IdentityMapping structs instead of pairs of
[]IDMap slices.
Existing code which uses []IDMap relies on zero-valued fields to be
valid, empty mappings. So in order to successfully finish the
refactoring without introducing bugs, their replacement therefore also
needs to have a useful zero value which represents an empty mapping.
Change IdentityMapping to be a pass-by-value type so that there are no
nil pointers to worry about.
The functionality provided by the deprecated NewIDMappingsFromMaps
function is required by unit tests to to construct arbitrary
IdentityMapping values. And the daemon will always need to access the
mappings to pass them to the Linux kernel. Accommodate these use cases
by exporting the struct fields instead. BuildKit currently depends on
the UIDs and GIDs methods so we cannot get rid of them yet.
Signed-off-by: Cory Snider <csnider@mirantis.com>
105 lines
3.3 KiB
Go
105 lines
3.3 KiB
Go
package dockerfile // import "github.com/docker/docker/builder/dockerfile"
|
|
|
|
import (
|
|
"bytes"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"github.com/containerd/containerd/platforms"
|
|
"github.com/docker/docker/api/types/container"
|
|
"github.com/docker/docker/api/types/mount"
|
|
"github.com/docker/docker/pkg/idtools"
|
|
"github.com/docker/docker/pkg/jsonmessage"
|
|
"golang.org/x/sys/windows"
|
|
)
|
|
|
|
func parseChownFlag(builder *Builder, state *dispatchState, chown, ctrRootPath string, identityMapping idtools.IdentityMapping) (idtools.Identity, error) {
|
|
if builder.options.Platform == "windows" {
|
|
return getAccountIdentity(builder, chown, ctrRootPath, state)
|
|
}
|
|
|
|
return identityMapping.RootPair(), nil
|
|
}
|
|
|
|
func getAccountIdentity(builder *Builder, accountName string, ctrRootPath string, state *dispatchState) (idtools.Identity, error) {
|
|
// If this is potentially a string SID then attempt to convert it to verify
|
|
// this, otherwise continue looking for the account.
|
|
if strings.HasPrefix(accountName, "S-") || strings.HasPrefix(accountName, "s-") {
|
|
sid, err := windows.StringToSid(accountName)
|
|
|
|
if err == nil {
|
|
return idtools.Identity{SID: sid.String()}, nil
|
|
}
|
|
}
|
|
|
|
// Attempt to obtain the SID using the name.
|
|
sid, _, accType, err := windows.LookupSID("", accountName)
|
|
|
|
// If this is a SID that is built-in and hence the same across all systems then use that.
|
|
if err == nil && (accType == windows.SidTypeAlias || accType == windows.SidTypeWellKnownGroup) {
|
|
return idtools.Identity{SID: sid.String()}, nil
|
|
}
|
|
|
|
// Check if the account name is one unique to containers.
|
|
if strings.EqualFold(accountName, "ContainerAdministrator") {
|
|
return idtools.Identity{SID: idtools.ContainerAdministratorSidString}, nil
|
|
|
|
} else if strings.EqualFold(accountName, "ContainerUser") {
|
|
return idtools.Identity{SID: idtools.ContainerUserSidString}, nil
|
|
}
|
|
|
|
// All other lookups failed, so therefore determine if the account in
|
|
// question exists in the container and if so, obtain its SID.
|
|
return lookupNTAccount(builder, accountName, state)
|
|
}
|
|
|
|
func lookupNTAccount(builder *Builder, accountName string, state *dispatchState) (idtools.Identity, error) {
|
|
|
|
source, _ := filepath.Split(os.Args[0])
|
|
|
|
target := "C:\\Docker"
|
|
targetExecutable := target + "\\containerutility.exe"
|
|
|
|
optionsPlatform, err := platforms.Parse(builder.options.Platform)
|
|
if err != nil {
|
|
return idtools.Identity{}, err
|
|
}
|
|
|
|
runConfig := copyRunConfig(state.runConfig,
|
|
withCmdCommentString("internal run to obtain NT account information.", optionsPlatform.OS))
|
|
|
|
runConfig.Cmd = []string{targetExecutable, "getaccountsid", accountName}
|
|
|
|
hostConfig := &container.HostConfig{Mounts: []mount.Mount{
|
|
{
|
|
Type: mount.TypeBind,
|
|
Source: source,
|
|
Target: target,
|
|
ReadOnly: true,
|
|
},
|
|
},
|
|
}
|
|
|
|
container, err := builder.containerManager.Create(runConfig, hostConfig)
|
|
if err != nil {
|
|
return idtools.Identity{}, err
|
|
}
|
|
|
|
stdout := new(bytes.Buffer)
|
|
stderr := new(bytes.Buffer)
|
|
|
|
if err := builder.containerManager.Run(builder.clientCtx, container.ID, stdout, stderr); err != nil {
|
|
if err, ok := err.(*statusCodeError); ok {
|
|
return idtools.Identity{}, &jsonmessage.JSONError{
|
|
Message: stderr.String(),
|
|
Code: err.StatusCode(),
|
|
}
|
|
}
|
|
return idtools.Identity{}, err
|
|
}
|
|
|
|
accountSid := stdout.String()
|
|
|
|
return idtools.Identity{SID: accountSid}, nil
|
|
}
|