From 6594d5c042a2253386820a640b3a7087e07d0df2 Mon Sep 17 00:00:00 2001 From: xiadanni Date: Thu, 9 Jul 2020 15:56:54 +0800 Subject: [PATCH] runc: fix permission denied reason: when exec as root and config.Cwd is not owned by root, exec will fail because root doesn't have the caps. Signed-off-by: Kurnia D Win Signed-off-by: xiadanni --- libcontainer/init_linux.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libcontainer/init_linux.go b/libcontainer/init_linux.go index 2a93431..73505ef 100644 --- a/libcontainer/init_linux.go +++ b/libcontainer/init_linux.go @@ -118,6 +118,11 @@ func finalizeNamespace(config *initConfig) error { if err := utils.CloseExecFrom(config.PassedFilesCount + 3); err != nil { return err } + if config.Cwd != "" { + if err := syscall.Chdir(config.Cwd); err != nil { + return fmt.Errorf("chdir to cwd (%q) set in config.json failed: %v", config.Cwd, err) + } + } capabilities := &configs.Capabilities{} if config.Capabilities != nil { @@ -146,11 +151,6 @@ func finalizeNamespace(config *initConfig) error { if err := w.ApplyCaps(); err != nil { return err } - if config.Cwd != "" { - if err := syscall.Chdir(config.Cwd); err != nil { - return fmt.Errorf("chdir to cwd (%q) set in config.json failed: %v", config.Cwd, err) - } - } return nil } -- 1.8.3.1