linux: do not skip EACCES in do_masked_or_readonly_path - #2145
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Ephemeral COPR build failed. @containers/packit-build please check. |
|
I am not sure yet whether we need this change |
|
The Since this is run by If anything, runc should be changed to match that. Also, crun can print a warning but I'm not sure those warnings are visible by upper level runtimes (and their users). |
|
@Rajkaran-122 are you ok to change it to a debug/warning message? |
|
Thanks for the clarification, @giuseppe sir and @kolyshkin sir. That makes sense. I'm happy to update the PR to log a debug/warning message on EACCES while preserving the current behavior. I'll make that change. |
giuseppe
left a comment
giuseppe
left a comment
There was a problem hiding this comment.
please squash in a single commit and adjust the commit message, no need to use a fixup.
| return pathfd; | ||
|
|
||
| if (errno == EACCES) | ||
| libcrun_debug ("skipping inaccessible path %s", rel_path); |
There was a problem hiding this comment.
quote the string %s with `%s`.
2484746 to
ec5e29f
Compare
When opening a masked or read-only path returns EACCES, log a debug message while preserving the existing behavior of skipping the path. Continue silently skipping ENOENT. Signed-off-by: Rajkaran Yadav <yadavrajkaran854@gmail.com>
ec5e29f to
3cfb471
Compare
|
Thanks for the review @giuseppe sir ! I looked into the remaining Test (system-blake3) failure. It appears the GitHub-hosted runner lost communication before the system-blake3 test started. Since this PR only changes src/libcrun/linux.c and doesn't affect the test workflow or system-blake3, the failure appears unrelated to this change. Please let me know if you'd like me to investigate further. |
no it is fine, the failures are not related to this change. |
|
@kolyshkin are you OK with the last version? |
3 participants
Description:
When attempting to open a masked or read-only path,
crunwas silently ignoring bothENOENTandEACCESerrors.To maintain consistency with
runc's fail-closed behavior, this commit updates the logic so that onlyENOENTis silently ignored. IfEACCESis encountered, the error is now properly propagated, preventing potential protection bypasses if a masked/readonly paths entry cannot be opened due to permissions.Fixes: #2139