Validate the bind-propagation option to --mount#24124
Validate the bind-propagation option to --mount#24124openshift-merge-bot[bot] merged 1 commit intocontainers:mainfrom
--mount#24124Conversation
|
LGTM but test not happy. |
pkg/specgenutil/volumes.go
Outdated
There was a problem hiding this comment.
not blocking but I would just log arg and then remove the for bind-propagation part.
test/e2e/run_volume_test.go
Outdated
There was a problem hiding this comment.
s/bind_propagation/bind-propagation
2a263d0 to
a8c046c
Compare
pkg/specgenutil/volumes.go
Outdated
There was a problem hiding this comment.
Note I specifically said arg not value because then it says bind-propagation=fake in the error and not just fake which may be harder to spot the error if there are a lot of mount options given
Similar to github.com/containers/buildah/pull/5761 but not security critical as Podman does not have an expectation that mounts are scoped (the ability to write a --mount option is already the ability to mount arbitrary content into the container so sneaking arbitrary options into the mount doesn't have security implications). Still, bad practice to let users inject anything into the mount command line so let's not do that. Signed-off-by: Matt Heon <mheon@redhat.com>
a8c046c to
985b57d
Compare
|
Two flakes, I think? Restarted both. |
|
Ready for merge |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Luap99, mheon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Similar to github.com/containers/buildah/pull/5761 but not security critical as Podman does not have an expectation that mounts are scoped (the ability to write a --mount option is already the ability to mount arbitrary content into the container so sneaking arbitrary options into the mount doesn't have security implications). Still, bad practice to let users inject anything into the mount command line so let's not do that.
Does this PR introduce a user-facing change?