Recursive propagation flags should be legal to use #543
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Current root propagation code does not allow rslave, rshared, runbindable and rprivate. These are all legal proagations and should be allowed. Also added the "bad" propagation flag to the error to make diagnosis easier. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
rhatdan
added a commit
to rhatdan/podman
that referenced
this pull request
Dec 15, 2017
I have opened a PR to allow the recursive flags in the runtime-tools package. opencontainers/runtime-tools#543 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
rhatdan
added a commit
to rhatdan/podman
that referenced
this pull request
Dec 15, 2017
I have opened a PR to allow the recursive flags in the runtime-tools package. opencontainers/runtime-tools#543 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
rhatdan
added a commit
to rhatdan/podman
that referenced
this pull request
Dec 15, 2017
I have opened a PR to allow the recursive flags in the runtime-tools package. opencontainers/runtime-tools#543 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
|
On Fri, Dec 15, 2017 at 12:11:27PM +0000, Daniel J Walsh wrote:
Current root propagation code does not allow rslave, rshared, runbindable and rprivate.
These are all legal proagations and should be allowed.
They are not listed in the normative runtime-spec Markdown [1], and
are forbidden by the informative runtime-spec JSON Schema [2].
However, without RFC 2119 wording in [1] I would consider them
technically allowed. I have opencontainers/runtime-spec#923 open
about clarifying the spec.
I'm agnostic for this PR. On the one hand, being able to write these
not-RFC-2119-forbidden values is nice (although with that approach, we
should let SetLinuxRootPropagation write *any* string value). These
configs are going to fail verification, where we rely on the spec's
JSON Schema since #197, but maybe folks won't run our verification on
them ;).
[1]: https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config-linux.md#rootfs-mount-propagation
[2]: https://github.com/opencontainers/runtime-spec/blob/v1.0.1/schema/defs-linux.json#L3-L11
|
|
@mrunalp @crosbymichael PTAL |
|
@rhvgoyal PTAL |
rhatdan
added a commit
to rhatdan/podman
that referenced
this pull request
Dec 18, 2017
I have opened a PR to allow the recursive flags in the runtime-tools package. opencontainers/runtime-tools#543 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
rhatdan
added a commit
to rhatdan/podman
that referenced
this pull request
Dec 18, 2017
I have opened a PR to allow the recursive flags in the runtime-tools package. opencontainers/runtime-tools#543 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
|
LGTM |
|
LGTM We also need another PR to add this change to: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Current root propagation code does not allow rslave, rshared, runbindable and rprivate.
These are all legal proagations and should be allowed.
Also added the "bad" propagation flag to the error to make diagnosis easier.
Signed-off-by: Daniel J Walsh dwalsh@redhat.com