Validate the bind-propagation option to --mount
#24124
Conversation
openshift-ci
bot
added
release-note-none
approved
|
LGTM but test not happy. |
pkg/specgenutil/volumes.go
Outdated
| case "shared", "rshared", "private", "rprivate", "slave", "rslave", "unbindable", "runbindable": | ||
| // Do nothing, sane value | ||
| default: | ||
| return nil, fmt.Errorf("invalid value %q for bind-propagation mount option", value) |
There was a problem hiding this comment.
not blocking but I would just log arg and then remove the for bind-propagation part.
test/e2e/run_volume_test.go
Outdated
| @@ -122,6 +122,10 @@ var _ = Describe("Podman run with volumes", func() { | |||
| session.WaitWithDefaultTimeout() | |||
| Expect(session).To(ExitWithError(125, `"notmpcopyup" option not supported for "bind" mount types`)) | |||
|
|
|||
| session = podmanTest.Podman([]string{"run", "--rm", "--mount", "type=bind,src=/tmp,target=/tmp,bind_propagation=fake", ALPINE, "true"}) | |||
There was a problem hiding this comment.
s/bind_propagation/bind-propagation
mheon
force-pushed
the
validate_bind_propagation
branch
2 times, most recently
from
2a263d0 to
a8c046c
Compare
pkg/specgenutil/volumes.go
Outdated
| case "shared", "rshared", "private", "rprivate", "slave", "rslave", "unbindable", "runbindable": | ||
| // Do nothing, sane value | ||
| default: | ||
| return nil, fmt.Errorf("invalid value %q for mount option", value) |
There was a problem hiding this comment.
Note I specifically said arg not value because then it says bind-propagation=fake in the error and not just fake which may be harder to spot the error if there are a lot of mount options given
Similar to github.com/containers/buildah/pull/5761 but not security critical as Podman does not have an expectation that mounts are scoped (the ability to write a --mount option is already the ability to mount arbitrary content into the container so sneaking arbitrary options into the mount doesn't have security implications). Still, bad practice to let users inject anything into the mount command line so let's not do that. Signed-off-by: Matt Heon <[email protected]>
mheon
force-pushed
the
validate_bind_propagation
branch
from
a8c046c to
985b57d
Compare
|
Two flakes, I think? Restarted both. |
|
Ready for merge |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Luap99, mheon The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Similar to github.com/containers/buildah/pull/5761 but not security critical as Podman does not have an expectation that mounts are scoped (the ability to write a --mount option is already the ability to mount arbitrary content into the container so sneaking arbitrary options into the mount doesn't have security implications). Still, bad practice to let users inject anything into the mount command line so let's not do that.
Does this PR introduce a user-facing change?