From 8cd112d8295bafcf4a992816ff9e07f5a78ff71b Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Mon, 27 Oct 2025 16:42:59 +0900 Subject: [PATCH] Fix directory permissions - Create /var/lib/containerd with 0o700 (was: 0o711). - Create config.TempDir with 0o700 (was: 0o711). - Create /run/containerd/io.containerd.grpc.v1.cri with 0o700 (was: 0o755). - Create /run/containerd/io.containerd.sandbox.controller.v1.shim with 0o700 (was: 0o711). - Leave /run/containerd and /run/containerd/io.containerd.runtime.v2.task created with 0o711, as required by userns-remapped containers. /run/containerd/io.containerd.runtime.v2.task// is created with: - 0o700 for non-userns-remapped containers - 0o710 for userns-remapped containers with the remapped root group as the owner group. Signed-off-by: Akihiro Suda (cherry picked from commit 51b0cf11dc5af7ed1919beba259e644138b28d96) Signed-off-by: Akihiro Suda --- cmd/containerd/server/server.go | 14 ++++++++++++-- core/runtime/v2/task_manager.go | 2 ++ plugins/cri/runtime/plugin.go | 7 +++++++ plugins/sandbox/controller.go | 6 +++++- 4 files changed, 26 insertions(+), 3 deletions(-) diff --git a/cmd/containerd/server/server.go b/cmd/containerd/server/server.go index 482276e7b3..fd0f9b430a 100644 --- a/cmd/containerd/server/server.go +++ b/cmd/containerd/server/server.go @@ -80,10 +80,16 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error { return errors.New("root and state must be different paths") } - if err := sys.MkdirAllWithACL(config.Root, 0o711); err != nil { + if err := sys.MkdirAllWithACL(config.Root, 0o700); err != nil { + return err + } + // chmod is needed for upgrading from an older release that created the dir with 0o711 + if err := os.Chmod(config.Root, 0o700); err != nil { return err } + // For supporting userns-remapped containers, the state dir cannot be just mkdired with 0o700. + // Each of plugins creates a dedicated directory beneath the state dir with appropriate permission bits. if err := sys.MkdirAllWithACL(config.State, 0o711); err != nil { return err } @@ -98,7 +104,11 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error { } if config.TempDir != "" { - if err := sys.MkdirAllWithACL(config.TempDir, 0o711); err != nil { + if err := sys.MkdirAllWithACL(config.TempDir, 0o700); err != nil { + return err + } + // chmod is needed for upgrading from an older release that created the dir with 0o711 + if err := os.Chmod(config.Root, 0o700); err != nil { return err } if runtime.GOOS == "windows" { diff --git a/core/runtime/v2/task_manager.go b/core/runtime/v2/task_manager.go index 4140422a4d..c4885d5ce0 100644 --- a/core/runtime/v2/task_manager.go +++ b/core/runtime/v2/task_manager.go @@ -75,6 +75,8 @@ func init() { shimManager := shimManagerI.(*ShimManager) root, state := ic.Properties[plugins.PropertyRootDir], ic.Properties[plugins.PropertyStateDir] for _, d := range []string{root, state} { + // root: the parent of this directory is created as 0o700, not 0o711. + // state: the parent of this directory is created as 0o711 too, so as to support userns-remapped containers. if err := os.MkdirAll(d, 0711); err != nil { return nil, err } diff --git a/plugins/cri/runtime/plugin.go b/plugins/cri/runtime/plugin.go index 6afd0ddb5f..c3c401ab91 100644 --- a/plugins/cri/runtime/plugin.go +++ b/plugins/cri/runtime/plugin.go @@ -79,6 +79,13 @@ func initCRIRuntime(ic *plugin.InitContext) (interface{}, error) { rootDir := filepath.Join(containerdRootDir, "io.containerd.grpc.v1.cri") containerdStateDir := filepath.Dir(ic.Properties[plugins.PropertyStateDir]) stateDir := filepath.Join(containerdStateDir, "io.containerd.grpc.v1.cri") + if err := os.MkdirAll(stateDir, 0o700); err != nil { + return nil, err + } + // chmod is needed for upgrading from an older release that created the dir with 0o755 + if err := os.Chmod(stateDir, 0o700); err != nil { + return nil, err + } c := criconfig.Config{ RuntimeConfig: *pluginConfig, ContainerdRootDir: containerdRootDir, diff --git a/plugins/sandbox/controller.go b/plugins/sandbox/controller.go index aec9cc3466..165f2e897d 100644 --- a/plugins/sandbox/controller.go +++ b/plugins/sandbox/controller.go @@ -68,7 +68,11 @@ func init() { state := ic.Properties[plugins.PropertyStateDir] root := ic.Properties[plugins.PropertyRootDir] for _, d := range []string{root, state} { - if err := os.MkdirAll(d, 0711); err != nil { + if err := os.MkdirAll(d, 0700); err != nil { + return nil, err + } + // chmod is needed for upgrading from an older release that created the dir with 0o711 + if err := os.Chmod(d, 0o700); err != nil { return nil, err } }