diff options
Diffstat (limited to 'hst')
| -rw-r--r-- | hst/container.go | 10 | ||||
| -rw-r--r-- | hst/container_test.go | 6 | ||||
| -rw-r--r-- | hst/hst_test.go | 1 |
3 files changed, 14 insertions, 3 deletions
diff --git a/hst/container.go b/hst/container.go index a34efc32..824b0982 100644 --- a/hst/container.go +++ b/hst/container.go @@ -65,6 +65,8 @@ const ( // Some programs fail to connect to dbus session running as a different uid, // this option works around it by mapping priv-side caller uid in container. FMapRealUID + // FNoPlace disables placement of /etc/passwd and /etc/group. + FNoPlace // FDevice mount /dev/ from the init mount namespace as is in the container // mount namespace. @@ -101,6 +103,8 @@ func (flags Flags) String() string { return "tty" case FMapRealUID: return "mapuid" + case FNoPlace: + return "noplace" case FDevice: return "device" case FCoverRun: @@ -197,6 +201,8 @@ type containerConfigJSON = struct { // Corresponds to [FMapRealUID]. MapRealUID bool `json:"map_real_uid"` + // Corresponds to [FNoPlace]. + NoPlace bool `json:"noplace,omitempty"` // Corresponds to [FDevice]. Device bool `json:"device,omitempty"` @@ -224,6 +230,7 @@ func (c *ContainerConfig) MarshalJSON() ([]byte, error) { Tty: c.Flags&FTty != 0, Multiarch: c.Flags&FMultiarch != 0, MapRealUID: c.Flags&FMapRealUID != 0, + NoPlace: c.Flags&FNoPlace != 0, Device: c.Flags&FDevice != 0, CoverRun: c.Flags&FCoverRun != 0, ShareRuntime: c.Flags&FShareRuntime != 0, @@ -266,6 +273,9 @@ func (c *ContainerConfig) UnmarshalJSON(data []byte) error { if v.MapRealUID { c.Flags |= FMapRealUID } + if v.NoPlace { + c.Flags |= FNoPlace + } if v.Device { c.Flags |= FDevice } diff --git a/hst/container_test.go b/hst/container_test.go index 309c0a63..a44014ea 100644 --- a/hst/container_test.go +++ b/hst/container_test.go @@ -21,8 +21,8 @@ func TestFlagsString(t *testing.T) { }{ {"none", 0, "none"}, {"none high", hst.FAll + 1, "none"}, - {"all", hst.FAll, "multiarch, compat, devel, userns, net, abstract, tty, mapuid, device, cover_run, runtime, tmpdir"}, - {"all high", math.MaxUint, "multiarch, compat, devel, userns, net, abstract, tty, mapuid, device, cover_run, runtime, tmpdir"}, + {"all", hst.FAll, "multiarch, compat, devel, userns, net, abstract, tty, mapuid, noplace, device, cover_run, runtime, tmpdir"}, + {"all high", math.MaxUint, "multiarch, compat, devel, userns, net, abstract, tty, mapuid, noplace, device, cover_run, runtime, tmpdir"}, } for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { @@ -53,7 +53,7 @@ func TestContainerConfig(t *testing.T) { {"hostnet hostabstract mapuid", &hst.ContainerConfig{Flags: hst.FHostNet | hst.FHostAbstract | hst.FMapRealUID}, `{"env":null,"filesystem":null,"shell":null,"home":null,"args":null,"host_net":true,"host_abstract":true,"map_real_uid":true}`}, {"all", &hst.ContainerConfig{Flags: hst.FAll}, - `{"env":null,"filesystem":null,"shell":null,"home":null,"args":null,"seccomp_compat":true,"devel":true,"userns":true,"host_net":true,"host_abstract":true,"tty":true,"multiarch":true,"map_real_uid":true,"device":true,"cover_run":true,"share_runtime":true,"share_tmpdir":true}`}, + `{"env":null,"filesystem":null,"shell":null,"home":null,"args":null,"seccomp_compat":true,"devel":true,"userns":true,"host_net":true,"host_abstract":true,"tty":true,"multiarch":true,"map_real_uid":true,"noplace":true,"device":true,"cover_run":true,"share_runtime":true,"share_tmpdir":true}`}, } for _, tc := range testCases { diff --git a/hst/hst_test.go b/hst/hst_test.go index c5e2cb12..83ea225e 100644 --- a/hst/hst_test.go +++ b/hst/hst_test.go @@ -244,6 +244,7 @@ func TestTemplate(t *testing.T) { "tty": true, "multiarch": true, "map_real_uid": true, + "noplace": true, "device": true, "cover_run": true, "share_runtime": true, |