[pve-devel] applied: [PATCH container] fix #3960: properly set owner in CT setup

[Thomas Lamprecht]

On 28.03.22 10:06, Fabian Grünbichler wrote:
> there were two helpers that were not handling this correctly:
> 
> ct_make_path
> 
> since this never gets called with $opts, and there also is no 'owner'
> and 'group' in $self, the previous logic could never work, sometimes
> leaving nobody:nogroup files around for unprivileged containers.
> 
> since only the centos and suse plugins use this helper, the issue was
> fairly limited.
> 
> ct_symlink
> 
> could create symlinks owned by nobody:nogroup. since symlinks are
> created 777 by default, this just meant they were not modifiable inside
> the container, but reading/dereferencing was no problem so it went
> unnoticed so far.
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
> ---
> 
> Notes:
>     instead of POSIX::lchown we could also expose AT_SYMLINK_NOFOLLOW in PVE::Tools
>     and call fchownat with that, but it would require a versioned dep bump..

we can still do that in the future with this patch applied if its really deemed
an improved, and be it just to make it More Nice Code™.

> 
>  src/PVE/LXC/Setup/Base.pm | 25 +++++++++++++++----------
>  1 file changed, 15 insertions(+), 10 deletions(-)
> 
>

applied, thanks!