From 489f57b877204e9e118c53b5c43f67674786b02a Mon Sep 17 00:00:00 2001 From: Adam Williams Date: Thu, 29 Apr 2021 10:41:19 -0700 Subject: [PATCH] Add security privilege needed to write layers when windows VHDX used as docker data root Signed-off-by: Adam Williams --- daemon/graphdriver/windows/windows.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/daemon/graphdriver/windows/windows.go b/daemon/graphdriver/windows/windows.go index 04a027f69b..4e4a112b66 100644 --- a/daemon/graphdriver/windows/windows.go +++ b/daemon/graphdriver/windows/windows.go @@ -832,13 +832,13 @@ func writeLayerReexec() { // writeLayer writes a layer from a tar file. func writeLayer(layerData io.Reader, home string, id string, parentLayerPaths ...string) (size int64, retErr error) { - err := winio.EnableProcessPrivileges([]string{winio.SeBackupPrivilege, winio.SeRestorePrivilege}) + err := winio.EnableProcessPrivileges([]string{winio.SeSecurityPrivilege, winio.SeBackupPrivilege, winio.SeRestorePrivilege}) if err != nil { return 0, err } if noreexec { defer func() { - if err := winio.DisableProcessPrivileges([]string{winio.SeBackupPrivilege, winio.SeRestorePrivilege}); err != nil { + if err := winio.DisableProcessPrivileges([]string{winio.SeSecurityPrivilege, winio.SeBackupPrivilege, winio.SeRestorePrivilege}); err != nil { // This should never happen, but just in case when in debugging mode. // See https://github.com/docker/docker/pull/28002#discussion_r86259241 for rationale. panic("Failed to disabled process privileges while in non re-exec mode")