Skip to content

Commit 0450f04

Browse files
committed
Fix directory permissions
- Create /var/lib/containerd with 0o700 (was: 0o711). - Create config.TempDir with 0o700 (was: 0o711). - Create /run/containerd/io.containerd.grpc.v1.cri with 0o700 (was: 0o755). - Create /run/containerd/io.containerd.sandbox.controller.v1.shim with 0o700 (was: 0o711). - Leave /run/containerd and /run/containerd/io.containerd.runtime.v2.task created with 0o711, as required by userns-remapped containers. /run/containerd/io.containerd.runtime.v2.task/<NS>/<ID> is created with: - 0o700 for non-userns-remapped containers - 0o710 for userns-remapped containers with the remapped root group as the owner group. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> (cherry picked from commit 51b0cf11dc5af7ed1919beba259e644138b28d96) Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
1 parent 08bf22d commit 0450f04

File tree

3 files changed

+21
-2
lines changed

3 files changed

+21
-2
lines changed

pkg/cri/cri.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,13 @@ func initCRIService(ic *plugin.InitContext) (interface{}, error) {
7474
}
7575
}
7676

77+
if err := os.MkdirAll(ic.State, 0700); err != nil {
78+
return nil, err
79+
}
80+
// chmod is needed for upgrading from an older release that created the dir with 0755
81+
if err := os.Chmod(ic.State, 0700); err != nil {
82+
return nil, err
83+
}
7784
c := criconfig.Config{
7885
PluginConfig: *pluginConfig,
7986
ContainerdRootDir: filepath.Dir(ic.Root),

runtime/v2/manager.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,8 @@ type ManagerConfig struct {
134134
// NewShimManager creates a manager for v2 shims
135135
func NewShimManager(ctx context.Context, config *ManagerConfig) (*ShimManager, error) {
136136
for _, d := range []string{config.Root, config.State} {
137+
// root: the parent of this directory is created as 0700, not 0711.
138+
// state: the parent of this directory is created as 0711 too, so as to support userns-remapped containers.
137139
if err := os.MkdirAll(d, 0711); err != nil {
138140
return nil, err
139141
}

services/server/server.go

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,10 +77,16 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
7777
return errors.New("root and state must be different paths")
7878
}
7979

80-
if err := sys.MkdirAllWithACL(config.Root, 0711); err != nil {
80+
if err := sys.MkdirAllWithACL(config.Root, 0700); err != nil {
81+
return err
82+
}
83+
// chmod is needed for upgrading from an older release that created the dir with 0o711
84+
if err := os.Chmod(config.Root, 0700); err != nil {
8185
return err
8286
}
8387

88+
// For supporting userns-remapped containers, the state dir cannot be just mkdired with 0o700.
89+
// Each of plugins creates a dedicated directory beneath the state dir with appropriate permission bits.
8490
if err := sys.MkdirAllWithACL(config.State, 0711); err != nil {
8591
return err
8692
}
@@ -95,7 +101,11 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
95101
}
96102

97103
if config.TempDir != "" {
98-
if err := sys.MkdirAllWithACL(config.TempDir, 0711); err != nil {
104+
if err := sys.MkdirAllWithACL(config.TempDir, 0700); err != nil {
105+
return err
106+
}
107+
// chmod is needed for upgrading from an older release that created the dir with 0o711
108+
if err := os.Chmod(config.Root, 0700); err != nil {
99109
return err
100110
}
101111
if runtime.GOOS == "windows" {

0 commit comments

Comments
 (0)