erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-08-05 08:25:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
spiegel_podman/pkg/util
History
Chris Evich c32edd121d
Only prevent VTs to be mounted inside privileged systemd containers 
While mounting virtual console devices in a systemd container is a
recipe for disaster (I experienced it first hand), mounting serial
console devices, modems, and others should still be done by default
for privileged systemd-based containers.

v2, addressing the review from @fho:
 - use backticks in the regular expression to remove backslashes
 - pre-compile the regex at the package level
 - drop IsVirtualTerminalDevice (not needed for a one-liner)

v3, addressing the review from @fho and @rhatdan:
 - re-introduce a private function for matching the device names
 - use path.Match rather than a regex not to slow down startup time

Closes #16925.

Fixes: 5a2405ae1b ("Don't mount /dev/tty* inside privileged...")

Cherry-picked from f4c81b0aa5 with
conflict resolution (accept incoming test updates) and additional
systemdMode handling for rootless: only skip /dev/ptmx, /dev/tty,
and virtual consoles (tty0, tty1, ...); pass non-vt TTYs (ttyS0,
ttyACM0, etc.) through to privileged rootless containers.

AI-Attribution: Created/Modified with the assistance of AI: Cursor <Auto>

Signed-off-by: Martin Roukala (né Peres) <martin.roukala@mupuf.org>
Signed-off-by: Chris Evich <cevich@redhat.com>
Made-with: Cursor
2026-03-30 15:13:41 -04:00
..
camelcase linter: enable wastedassign 2022-03-22 13:04:34 +01:00
filters.go pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00
filters_test.go Unification of until filter across list/prune endpoints 2021-03-24 00:56:00 +01:00
kube.go Add support for play/generate kube volumes 2021-04-09 14:01:13 -06:00
mountOpts.go pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00
mountOpts_linux.go Turn off 'noexec' option by default for named volumes 2020-05-20 16:48:20 -04:00
mountOpts_other.go go fmt: use go 1.18 conditional-build syntax 2022-03-18 09:11:53 +01:00
utils.go pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00
utils_darwin.go pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00
utils_linux.go Only prevent VTs to be mounted inside privileged systemd containers 2026-03-30 15:13:41 -04:00
utils_linux_test.go Fix up errors found by codespell 2020-09-11 06:14:25 -04:00
utils_supported.go pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00
utils_test.go Merge pull request #11218 from cdoern/untilBug 2021-08-26 10:12:09 -04:00
utils_unsupported.go pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00
utils_windows.go pkg: switch to golang native error wrapping 2022-07-08 08:54:47 +02:00