fix: gracefully handle missing CAP_CHOWN in rootless containers#32
Open
slauger wants to merge 1 commit intoOpenVoxProject:mainfrom
Open
fix: gracefully handle missing CAP_CHOWN in rootless containers#32slauger wants to merge 1 commit intoOpenVoxProject:mainfrom
slauger wants to merge 1 commit intoOpenVoxProject:mainfrom
Conversation
slauger
force-pushed
the
fix/rootless-chown
branch
from
a41ca66 to
5bce4cf
Compare
|
This appears to be a quick fix that could introduce unintended consequences. Perhaps we should implement your alternative approach and make it configurable via an environment variable instead. |
Contributor
|
In OpenVoxProject/openvox#362 we had a similar fix. There's already an option to skip permission management in openvox. We could check if it's set to false and then skip the chown. |
slauger
force-pushed
the
fix/rootless-chown
branch
from
5bce4cf to
c53628d
Compare
Member
Author
|
Replaced the previous |
Guard all three FileUtils.chown call sites in file_system.rb with the existing running_as_root? check so that openvoxserver-ca no longer crashes when running inside rootless containers (e.g. podman rootless, OpenShift with arbitrary UIDs) where the process lacks CAP_CHOWN. Affected methods: forcibly_symlink, write_file, ensure_dir. In these environments file ownership is typically managed through SGID bits and g=u permission patterns instead of explicit chown calls. Inspired by the approach in OpenVoxProject#30. Signed-off-by: Simon Lauger <simon@lauger.de>
slauger
force-pushed
the
fix/rootless-chown
branch
from
5021079 to
474eccd
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
FileUtils.chowncall sites infile_system.rbwith the existingrunning_as_root?check so they are skipped in rootless containersforcibly_symlink,write_file, andensure_dirg=upermission patterns instead of explicit chownThis approach reuses the
running_as_root?method that already exists in the class (used byfind_user_and_group), keeping the logic consistent. Inspired by the approach in #30.This eliminates the need for sed patches in container images (see OpenVoxProject/container-openvoxserver#123).
Test plan
forcibly_symlink,write_file, andensure_dir(root and non-root paths)puppetserver ca setupin a rootless podman container and verify it completes without errorpuppetserver ca setupas root and verify ownership is still set correctlyRef: OpenVoxProject/container-openvoxserver#123