PodMounter: Add group read access to credentials if Pod is not root #388
+197
−35
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yerzhan7
temporarily deployed
to
approval-gate
GitHub Actions
Inactive
unexge
reviewed
Feb 24, 2025
| @@ -36,24 +36,28 @@ const targetDirPerm = fs.FileMode(0755) | |||
| // This is mainly exposed for testing, in production platform-native function (`mountSyscallDefault`) will be used. | |||
| type mountSyscall func(target string, args mountpoint.Args) (fd int, err error) | |||
|
|
|||
| type fileGroupID func(path string) (gid uint32, err error) | |||
There was a problem hiding this comment.
Seems like this is only exposed for testing, and I feel like it would be cleaner if we just change the gid of the parent directory in our tests to test different cases via os.Chown.
| @@ -37,3 +45,18 @@ func ReplaceFile(destPath string, sourcePath string, perm fs.FileMode) error { | |||
|
|
|||
| return nil | |||
| } | |||
|
|
|||
| // FileGroupID returns gid of the file or directory. | |||
| func FileGroupID(path string) (gid uint32, err error) { | |||
There was a problem hiding this comment.
Since this is a public function, it would be nice to add some tests for this function in file_test.go.
Comment on lines
+12
to
+15
| FileMode600 = fs.FileMode(0600) // User: read/write, Group: none, Others: none | ||
| FileMode640 = fs.FileMode(0640) // User: read/write, Group: read-only, Others: none | ||
| FileMode700 = fs.FileMode(0700) // User: full access, Group: none, Others: none | ||
| FileMode750 = fs.FileMode(0750) // User: full access, Group: read/execute only, Others: none |
There was a problem hiding this comment.
I feel like it'd be nicer if we name these constants after their permissions, something like:
Suggested change
| FileMode600 = fs.FileMode(0600) // User: read/write, Group: none, Others: none | |
| FileMode640 = fs.FileMode(0640) // User: read/write, Group: read-only, Others: none | |
| FileMode700 = fs.FileMode(0700) // User: full access, Group: none, Others: none | |
| FileMode750 = fs.FileMode(0750) // User: full access, Group: read/execute only, Others: none | |
| FileModeUserReadWrite = fs.FileMode(0600) // User: read/write, Group: none, Others: none | |
| FileModeUserGroupReadWrite = fs.FileMode(0640) // User: read/write, Group: read-only, Others: none | |
| FileModeUserFull = fs.FileMode(0700) // User: full access, Group: none, Others: none | |
| FileModeUserFullGroupRead = fs.FileMode(0750) // User: full access, Group: read/execute only, Others: none |
Though, feel free to change them if you can come up with better names :)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue: #108
Description
fsGroupsecurity context is applied on Mountpoint Pod and it's not run as default root user (0), then currently Mountpoint Pod fails to read credentials that are provided by CSI Driver Node Pod.CredentialDirPermandCredentialFilePermfields to credential'sProvideContextBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.