GitList

Browse code

oci: correctly use user.GetExecUser interface

A nil interface in Go is not the same as a nil pointer that satisfies
the interface. libcontainer/user has special handling for missing
/etc/{passwd,group} files but this is all based on nil interface checks,
which were broken by Docker's usage of the API.

When combined with some recent changes in runc that made read errors
actually be returned to the caller, this results in spurrious -EINVAL
errors when we should detect the situation as "there is no passwd file".

Signed-off-by: Aleksa Sarai <asarai@suse.de>

Aleksa Sarai authored on 2020/07/29 11:43:43
Showing 1 changed files

daemon/oci_linux.go

History View file @ 3108ae6

@@ -176,7 +176,14 @@ func readUserFile(c *container.Container, p string) (io.ReadCloser, error) {
                      	if err != nil {
                      		return nil, err
+                     	}
                     -	return os.Open(fp)
                     +	fh, err := os.Open(fp)
                     +	if err != nil {
                     +		// This is needed because a nil *os.File is different to a nil
                     +		// io.ReadCloser and this causes GetExecUser to not detect that the
                     +		// container file is missing.
                     +		return nil, err
                     +	}
                     +	return fh, nil
+                     }
                      func getUser(c *container.Container, username string) (uint32, uint32, []uint32, error) {