additional_gids ignored on exec #644
Comments
owtaylor
added a commit
to owtaylor/crun
that referenced
this issue
Apr 9, 2021
…er definition The code was using the process defined in the container definition to find additional_gids, not the one passed on the command line or created by default. Fixes containers#644 Signed-off-by: Owen W. Taylor <otaylor@fishsoup.net>
This was referenced Feb 5, 2024
debarshiray
added a commit
to debarshiray/toolbox
that referenced
this issue
Feb 8, 2024
Commit 15173f8 exposed a bug in crun(1) [1] where the process started directly by 'podman exec --user ...' inside the Toolbx container would not have the supplementary groups that the user is a member of. This could be observed by differences in id(1): ⬢$ id uid=1000(user) gid=1000(user) groups=1000(user) ⬢$ id user uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) ... and could be worked around by starting a new session with sudo(8). [1] crun commit 9effaebb429a1aed containers/crun@9effaebb429a1aed containers/crun#644 containers/podman#9986 containers#608
debarshiray
added a commit
to debarshiray/toolbox
that referenced
this issue
Feb 9, 2024
Commit 15173f8 exposed a bug in crun(1) [1] where the process started directly by 'podman exec --user ...' inside the Toolbx container would not have the supplementary groups attached to the user by the entry point. This could be observed by differences in id(1): ⬢$ id uid=1000(user) gid=1000(user) groups=1000(user) ⬢$ id user uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) ... and could be worked around by starting a new session with sudo(8). [1] crun commit 9effaebb429a1aed containers/crun@9effaebb429a1aed containers/crun#644 containers/podman#9986 containers#608
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When setting up gids for for exec, the
user: {}definition in the process spec is ignored and the one in the container is used instead. See containers/podman#9986 for a reproducer with podman.Will file a pull request with an attempt at a fix for the problem.
The text was updated successfully, but these errors were encountered: