containers / virtcontainers

A Go package for building hardware virtualized container runtimes
Apache License 2.0
139 stars 43 forks source link

/var/lib/virtcontainers (and subdirs) as chmod 01000 (d---------) #638

Closed grahamwhaley closed 6 years ago

grahamwhaley commented 6 years ago

I'd removed my /var/lib/virtcontainers/pods dir (it was dirty), and tried to run the 'make functional' tests from the cc tests repo, and got some errors like:

...
Stderr: open /var/lib/virtcontainers/pods: permission denied
...

Running up a single cc-runtime container and having a look down in /var/lib/virtcontainers shows us:

$ ls -laR virtcontainers
virtcontainers:
total 12
d---------  3 root root 4096 Feb 26 16:58 .
drwxr-xr-x 50 root root 4096 Feb 26 16:58 ..
d---------  3 root root 4096 Feb 26 16:58 pods

virtcontainers/pods:
total 12
d--------- 3 root root 4096 Feb 26 16:58 .
d--------- 3 root root 4096 Feb 26 16:58 ..
d--------- 3 root root 4096 Feb 26 16:58 b9634f3cb5b46b4dc8500176c9f8c27a132b0f1e9f3f0be7ccc3c116541394dd

virtcontainers/pods/b9634f3cb5b46b4dc8500176c9f8c27a132b0f1e9f3f0be7ccc3c116541394dd:
total 64
d--------- 3 root root  4096 Feb 26 16:58 .
d--------- 3 root root  4096 Feb 26 16:58 ..
drwxr-x--- 2 root root  4096 Feb 26 16:58 b9634f3cb5b46b4dc8500176c9f8c27a132b0f1e9f3f0be7ccc3c116541394dd
-rw-r--r-- 1 root root 52021 Feb 26 16:58 config.json

virtcontainers/pods/b9634f3cb5b46b4dc8500176c9f8c27a132b0f1e9f3f0be7ccc3c116541394dd/b9634f3cb5b46b4dc8500176c9f8c27a132b0f1e9f3f0be7ccc3c116541394dd:
total 36
drwxr-x--- 2 root root  4096 Feb 26 16:58 .
d--------- 3 root root  4096 Feb 26 16:58 ..
-rw-r--r-- 1 root root 26806 Feb 26 16:58 config.json

I think the root cause is coming from: https://github.com/containers/virtcontainers/blob/master/filesystem.go#L157 where we have code like:

err = os.MkdirAll(path, os.ModeDir)

the core issue being, although on the docs it says: The only required bit is ModeDir for directories - I believe what that means is that ModeDir is the directory bit - and you must have at least that for mkdir - but, what we are missing are the rest of the mode bits, from: https://github.com/containers/virtcontainers/blob/master/filesystem.go#L90

What I think we really need is something akin to:

os.ModeDir | dirMode