dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-03 14:41:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #50870 from vvoland/windows-fix-layer-perm

Browse Source 
graphdriver/windows: Potential fix for access denied
This commit is contained in:
Rob Murray
2025-09-02 09:17:57 +01:00
committed by GitHub
parent 0b772bd5da f66f555ad4
commit d2bb9bda29
1 changed files with 17 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
daemon/graphdriver/windows/windows.go
View File

@@ -799,37 +799,25 @@ func writeLayerReexec() {
}
// writeLayer writes a layer from a tar file.
func writeLayer(layerData io.Reader, home string, id string, parentLayerPaths ...string) (size int64, retErr error) {
err := winio.EnableProcessPrivileges([]string{winio.SeSecurityPrivilege, winio.SeBackupPrivilege, winio.SeRestorePrivilege})
if err != nil {
return 0, err
}
if noreexec {
defer func() {
if err := winio.DisableProcessPrivileges([]string{winio.SeSecurityPrivilege, winio.SeBackupPrivilege, winio.SeRestorePrivilege}); err != nil {
// This should never happen, but just in case when in debugging mode.
// See https://github.com/moby/moby/pull/28002#discussion_r86259241 for rationale.
panic("Failed to disabled process privileges while in non re-exec mode")
}
}()
}
w, err := hcsshim.NewLayerWriter(hcsshim.DriverInfo{Flavour: filterDriver, HomeDir: home}, id, parentLayerPaths)
if err != nil {
return 0, err
}
defer func() {
if err := w.Close(); err != nil {
// This error should not be discarded as a failure here
// could result in an invalid layer on disk
if retErr == nil {
retErr = err
}
func writeLayer(layerData io.Reader, home string, id string, parentLayerPaths ...string) (size int64, _ error) {
err := winio.RunWithPrivileges([]string{winio.SeSecurityPrivilege, winio.SeBackupPrivilege, winio.SeRestorePrivilege}, func() error {
var err error
w, err := hcsshim.NewLayerWriter(hcsshim.DriverInfo{Flavour: filterDriver, HomeDir: home}, id, parentLayerPaths)
if err != nil {
return err
}
}()
return writeLayerFromTar(layerData, w, filepath.Join(home, id))
s, err := writeLayerFromTar(layerData, w, filepath.Join(home, id))
if err != nil {
// Close, but don't override the error from writeLayerFromTar
_ = w.Close()
return err
}
size = s
return w.Close()
})
return size, err
}
// resolveID computes the layerID information based on the given id.