dilim/containerd
1
0
Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-08-09 17:39:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix directory permissions

Browse Source 
- Create /var/lib/containerd with 0o700 (was: 0o711).
- Create config.TempDir with 0o700 (was: 0o711).
- Create /run/containerd/io.containerd.grpc.v1.cri with 0o700 (was: 0o755).
- Create /run/containerd/io.containerd.sandbox.controller.v1.shim with 0o700 (was: 0o711).
- Leave /run/containerd and /run/containerd/io.containerd.runtime.v2.task created with 0o711,
  as required by userns-remapped containers.
  /run/containerd/io.containerd.runtime.v2.task/<NS>/<ID> is created with:
  - 0o700 for non-userns-remapped containers
  - 0o710 for userns-remapped containers with the remapped root group as the owner group.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit 51b0cf11dc5af7ed1919beba259e644138b28d96)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
Akihiro Suda
2025-10-27 16:42:59 +09:00
parent 7a3fa52242
commit 8cd112d829
4 changed files with 26 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
cmd/containerd/server/server.go
View File

@@ -80,10 +80,16 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
return errors.New("root and state must be different paths")
}
if err := sys.MkdirAllWithACL(config.Root, 0o711); err != nil {
if err := sys.MkdirAllWithACL(config.Root, 0o700); err != nil {
return err
}
// chmod is needed for upgrading from an older release that created the dir with 0o711
if err := os.Chmod(config.Root, 0o700); err != nil {
return err
}
// For supporting userns-remapped containers, the state dir cannot be just mkdired with 0o700.
// Each of plugins creates a dedicated directory beneath the state dir with appropriate permission bits.
if err := sys.MkdirAllWithACL(config.State, 0o711); err != nil {
return err
}
@@ -98,7 +104,11 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
}
if config.TempDir != "" {
if err := sys.MkdirAllWithACL(config.TempDir, 0o711); err != nil {
if err := sys.MkdirAllWithACL(config.TempDir, 0o700); err != nil {
return err
}
// chmod is needed for upgrading from an older release that created the dir with 0o711
if err := os.Chmod(config.Root, 0o700); err != nil {
return err
}
if runtime.GOOS == "windows" {

2
core/runtime/v2/task_manager.go
View File

@@ -75,6 +75,8 @@ func init() {
shimManager := shimManagerI.(*ShimManager)
root, state := ic.Properties[plugins.PropertyRootDir], ic.Properties[plugins.PropertyStateDir]
for _, d := range []string{root, state} {
// root: the parent of this directory is created as 0o700, not 0o711.
// state: the parent of this directory is created as 0o711 too, so as to support userns-remapped containers.
if err := os.MkdirAll(d, 0711); err != nil {
return nil, err
}

7
plugins/cri/runtime/plugin.go
View File

@@ -79,6 +79,13 @@ func initCRIRuntime(ic *plugin.InitContext) (interface{}, error) {
rootDir := filepath.Join(containerdRootDir, "io.containerd.grpc.v1.cri")
containerdStateDir := filepath.Dir(ic.Properties[plugins.PropertyStateDir])
stateDir := filepath.Join(containerdStateDir, "io.containerd.grpc.v1.cri")
if err := os.MkdirAll(stateDir, 0o700); err != nil {
return nil, err
}
// chmod is needed for upgrading from an older release that created the dir with 0o755
if err := os.Chmod(stateDir, 0o700); err != nil {
return nil, err
}
c := criconfig.Config{
RuntimeConfig: *pluginConfig,
ContainerdRootDir: containerdRootDir,

6
plugins/sandbox/controller.go
View File

@@ -68,7 +68,11 @@ func init() {
state := ic.Properties[plugins.PropertyStateDir]
root := ic.Properties[plugins.PropertyRootDir]
for _, d := range []string{root, state} {
if err := os.MkdirAll(d, 0711); err != nil {
if err := os.MkdirAll(d, 0700); err != nil {
return nil, err
}
// chmod is needed for upgrading from an older release that created the dir with 0o711
if err := os.Chmod(d, 0o700); err != nil {
return nil, err
}
}