mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-12-31 06:01:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

build_library: Don't preserve file ownership when copying sysext files

Browse Source 
The docker and containerd copy files from the repository, which are owned by
the sdk user. This ownership leaks into the final image, which means the first
created user could edit systemd files. This is bad.

Modify the cp invocation to copy files without preserving ownership. The
sysext-mangle script is called by build_sysext, which is executed using sudo.

Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
This commit is contained in:
Jeremi Piotrowski 2024-08-30 09:16:25 +02:00
parent 755933a978
commit 7749a0d5c4
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
build_library/sysext_mangle_containerd-flatcar
View File

@ -12,7 +12,8 @@ script_root="$(cd "$(dirname "$0")/../"; pwd)"
files_dir="${script_root}/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd"
echo ">>> NOTICE $0: installing extra files from '${files_dir}'"
cp -va "${files_dir}/"* "${rootfs}"
# ATTENTION: don't preserve ownership as repo is owned by sdk user
cp -vdR --preserve=mode,timestamps "${files_dir}/"* "${rootfs}"
mkdir -p "${rootfs}/usr/lib/systemd/system/multi-user.target.d"
{ echo "[Unit]"; echo "Upholds=containerd.service"; } > "${rootfs}/usr/lib/systemd/system/multi-user.target.d/10-containerd-service.conf"

3
build_library/sysext_mangle_docker-flatcar
View File

@ -11,7 +11,8 @@ script_root="$(cd "$(dirname "$0")/../"; pwd)"
files_dir="${script_root}/sdk_container/src/third_party/coreos-overlay/coreos/sysext/docker"
echo ">>> NOTICE $0: installing extra files from '${files_dir}'"
cp -va "${files_dir}/"* "${rootfs}"
# ATTENTION: don't preserve ownership as repo is owned by sdk user
cp -vdR --preserve=mode,timestamps "${files_dir}/"* "${rootfs}"
mkdir -p "${rootfs}/usr/lib/systemd/system/sockets.target.d"
{ echo "[Unit]"; echo "Upholds=docker.socket"; } > "${rootfs}/usr/lib/systemd/system/sockets.target.d/10-docker-socket.conf"