Skip to content
Permalink
Browse files

Add ADD/COPY --chown flag support to Windows

This fix actually implements chown support on Windows. Built-in accounts
as well as accounts included in the SAM database of the container are
supported.

The following are valid examples:
ADD --chown=Guest . <some directory>
COPY --chown=Administrator . <some directory>
COPY --chown=Guests . <some directory>
COPY --chown=ContainerUser . <some directory>

On Windows an owner is only granted the permission to read the security
descriptor and read/write the discretionary access control list. This
fix also grants read/write and execute permissions to the owner.

Signed-off-by: Salahuddin Khan <salah@docker.com>
  • Loading branch information...
salah-khan committed Dec 14, 2017
1 parent 576c2be commit 032e65d8a60c6f7fa2f3b18d88ae5cd2bdcb11ea
@@ -226,9 +226,9 @@ func (b *Builder) performCopy(state *dispatchState, inst copyInstruction) error
}

func parseChownFlag(builder *Builder, state *dispatchState, chown, ctrRootPath string, identityMapping *idtools.IdentityMapping) (idtools.Identity, error) {
// If the target platform is Windows then obtain the account identity the SAM database.
if builder.options.Platform == "windows" {
return getAccountIdentity(builder, chown, ctrRootPath, state)

} else {
var userStr, grpStr string

@@ -131,18 +131,8 @@ func Init(root string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
if err != nil {
return nil, err
}
<<<<<<< HEAD
// Create the root aufs driver dir
if err := idtools.MkdirAllAndChown(root, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
// Create the root aufs driver dir and return
// if it already exists
// If not populate the dir structure
if err := idtools.MkdirAllAs(root, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
if os.IsExist(err) {
return a, nil
}
>>>>>>> Support --chown on Windows.
return nil, err
}

@@ -152,11 +142,7 @@ func Init(root string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap

// Populate the dir structure
for _, p := range paths {
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(path.Join(root, p), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(path.Join(root, p), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return nil, err
}
}
@@ -308,11 +294,7 @@ func (a *Driver) createDirsFor(id string) error {
// The path of directories are <aufs_root_path>/mnt/<image_id>
// and <aufs_root_path>/diff/<image_id>
for _, p := range paths {
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(path.Join(a.rootPath(), p, id), 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(path.Join(a.rootPath(), p, id), 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}
}
@@ -73,11 +73,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
if err != nil {
return nil, err
}
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(home, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(home, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return nil, err
}

@@ -515,11 +511,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
if err != nil {
return err
}
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(subvolumes, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(subvolumes, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}
if parent == "" {
@@ -554,11 +546,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) error {
if err := d.setStorageSize(path.Join(subvolumes, id), driver); err != nil {
return err
}
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(quotas, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(quotas, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}
if err := ioutil.WriteFile(path.Join(quotas, id), []byte(fmt.Sprint(driver.options.size)), 0644); err != nil {
@@ -268,11 +268,7 @@ func (devices *DeviceSet) ensureImage(name string, size int64) (string, error) {
if err != nil {
return "", err
}
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(dirname, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil {
=======
if err := idtools.MkdirAllAs(dirname, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil && !os.IsExist(err) {
>>>>>>> Support --chown on Windows.
return "", err
}

@@ -1701,11 +1697,7 @@ func (devices *DeviceSet) initDevmapper(doInit bool) (retErr error) {
if err != nil {
return err
}
<<<<<<< HEAD
if err := idtools.MkdirAndChown(devices.root, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil {
=======
if err := idtools.MkdirAs(devices.root, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil && !os.IsExist(err) {
>>>>>>> Support --chown on Windows.
return err
}
if err := os.MkdirAll(devices.metadataDir(), 0700); err != nil {
@@ -189,19 +189,11 @@ func (d *Driver) Get(id, mountLabel string) (containerfs.ContainerFS, error) {
}

// Create the target directories if they don't exist
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(path.Join(d.home, "mnt"), 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil {
d.ctr.Decrement(mp)
return nil, err
}
if err := idtools.MkdirAndChown(mp, 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil && !os.IsExist(err) {
=======
if err := idtools.MkdirAllAs(path.Join(d.home, "mnt"), 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil && !os.IsExist(err) {
d.ctr.Decrement(mp)
return nil, err
}
if err := idtools.MkdirAs(mp, 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil && !os.IsExist(err) {
>>>>>>> Support --chown on Windows.
d.ctr.Decrement(mp)
return nil, err
}
@@ -212,11 +204,7 @@ func (d *Driver) Get(id, mountLabel string) (containerfs.ContainerFS, error) {
return nil, err
}

<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(rootFs, 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil {
=======
if err := idtools.MkdirAllAs(rootFs, 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: uid, GID: gid})); err != nil && !os.IsExist(err) {
>>>>>>> Support --chown on Windows.
d.ctr.Decrement(mp)
d.DeviceSet.UnmountDevice(id, mp)
return nil, err
@@ -180,6 +180,12 @@ func InitDriver(dataRoot string, options []string, _, _ []idtools.IDMap) (graphd
}
}

var identity idtools.Identity

identity.IdType = idtools.TypeIDPair
identity.IdPair.UID = 0
identity.IdPair.GID = 0

// Make sure the dataRoot directory is created
if err := idtools.MkdirAllAndChown(dataRoot, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: 0, GID: 0})); err != nil {
return nil, fmt.Errorf("%s failed to create '%s': %v", title, dataRoot, err)
@@ -160,11 +160,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
return nil, err
}
// Create the driver home dir
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(home, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(home, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil && !os.IsExist(err) {
>>>>>>> Support --chown on Windows.
return nil, err
}

@@ -275,19 +271,12 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr
if err != nil {
return err
}
<<<<<<< HEAD
root := idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})

if err := idtools.MkdirAllAndChown(path.Dir(dir), 0700, root); err != nil {
return err
}
if err := idtools.MkdirAndChown(dir, 0700, root); err != nil {
=======
if err := idtools.MkdirAllAs(path.Dir(dir), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
return err
}
if err := idtools.MkdirAs(dir, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}

@@ -300,11 +289,7 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr

// Toplevel images are just a "root" dir
if parent == "" {
<<<<<<< HEAD
return idtools.MkdirAndChown(path.Join(dir, "root"), 0755, root)
=======
return idtools.MkdirAndChown(path.Join(dir, "root"), 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID}))
>>>>>>> Support --chown on Windows.
}

parentDir := d.dir(parent)
@@ -318,20 +303,10 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr
parentRoot := path.Join(parentDir, "root")

if s, err := os.Lstat(parentRoot); err == nil {
<<<<<<< HEAD
if err := idtools.MkdirAndChown(path.Join(dir, "upper"), s.Mode(), root); err != nil {
return err
}
if err := idtools.MkdirAndChown(path.Join(dir, "work"), 0700, root); err != nil {
=======
if err := idtools.MkdirAs(path.Join(dir, "upper"), s.Mode(), idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
return err
}
if err := idtools.MkdirAs(path.Join(dir, "work"), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
return err
}
if err := idtools.MkdirAs(path.Join(dir, "merged"), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}
if err := ioutil.WriteFile(path.Join(dir, "lower-id"), []byte(parent), 0666); err != nil {
@@ -358,20 +333,10 @@ func (d *Driver) Create(id, parent string, opts *graphdriver.CreateOpts) (retErr
}

upperDir := path.Join(dir, "upper")
<<<<<<< HEAD
if err := idtools.MkdirAndChown(upperDir, s.Mode(), root); err != nil {
return err
}
if err := idtools.MkdirAndChown(path.Join(dir, "work"), 0700, root); err != nil {
=======
if err := idtools.MkdirAs(upperDir, s.Mode(), idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
return err
}
if err := idtools.MkdirAs(path.Join(dir, "work"), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
return err
}
if err := idtools.MkdirAs(path.Join(dir, "merged"), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}

@@ -196,11 +196,7 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
return nil, err
}
// Create the driver home dir
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(path.Join(home, linkDir), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(path.Join(home, linkDir), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil && !os.IsExist(err) {
>>>>>>> Support --chown on Windows.
return nil, err
}

@@ -382,19 +378,12 @@ func (d *Driver) create(id, parent string, opts *graphdriver.CreateOpts) (retErr
if err != nil {
return err
}
<<<<<<< HEAD
root := idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})

if err := idtools.MkdirAllAndChown(path.Dir(dir), 0700, root); err != nil {
return err
}
if err := idtools.MkdirAndChown(dir, 0700, root); err != nil {
=======
if err := idtools.MkdirAllAs(path.Dir(dir), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
return err
}
if err := idtools.MkdirAs(dir, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}

@@ -419,11 +408,7 @@ func (d *Driver) create(id, parent string, opts *graphdriver.CreateOpts) (retErr
}
}

<<<<<<< HEAD
if err := idtools.MkdirAndChown(path.Join(dir, "diff"), 0755, root); err != nil {
=======
if err := idtools.MkdirAs(path.Join(dir, "diff"), 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}

@@ -442,14 +427,7 @@ func (d *Driver) create(id, parent string, opts *graphdriver.CreateOpts) (retErr
return nil
}

<<<<<<< HEAD
if err := idtools.MkdirAndChown(path.Join(dir, "work"), 0700, root); err != nil {
=======
if err := idtools.MkdirAs(path.Join(dir, "work"), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
return err
}
if err := idtools.MkdirAs(path.Join(dir, "merged"), 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return err
}

@@ -104,11 +104,7 @@ func Init(base string, opt []string, uidMaps, gidMaps []idtools.IDMap) (graphdri
if err != nil {
return nil, fmt.Errorf("Failed to get root uid/guid: %v", err)
}
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(base, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(base, 0700, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
return nil, fmt.Errorf("Failed to create '%s': %v", base, err)
}

@@ -377,11 +373,7 @@ func (d *Driver) Get(id, mountLabel string) (containerfs.ContainerFS, error) {
return nil, err
}
// Create the target directories if they don't exist
<<<<<<< HEAD
if err := idtools.MkdirAllAndChown(mountpoint, 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
=======
if err := idtools.MkdirAllAs(mountpoint, 0755, idtools.NewIDPairIdentity(idtools.IDPair{UID: rootUID, GID: rootGID})); err != nil {
>>>>>>> Support --chown on Windows.
d.ctr.Decrement(mountpoint)
return nil, err
}

0 comments on commit 032e65d

Please sign in to comment.
You can’t perform that action at this time.