2c2481e1f5
... and fix CVE-2022-3064. Resolves: #2164980, #2165743
90 lines
3.2 KiB
Diff
90 lines
3.2 KiB
Diff
From fc5f568c5d82f4a16982268fa67092e52be91fbe Mon Sep 17 00:00:00 2001
|
|
From: Debarshi Ray <rishi@fedoraproject.org>
|
|
Date: Tue, 28 Feb 2023 17:12:04 +0100
|
|
Subject: [PATCH] cmd/root: Don't use podman(1) when generating the completions
|
|
|
|
Ever since commit bafbbe81c9220cb3, the shell completions are generated
|
|
while building Toolbx using the 'completion' command. This involves
|
|
running toolbox(1) itself, and hence invoking 'podman version' to decide
|
|
if 'podman system migrate' is needed or not.
|
|
|
|
Unfortunately, some build environments, like Fedora's, are set up inside
|
|
a chroot(2) or systemd-nspawn(1) or similar, where 'podman version' may
|
|
not work because it does various things with namespaces(7) and clone(2)
|
|
that can, under certain circumstances, encounter an EPERM.
|
|
|
|
Therefore, it's better to avoid using podman(1) when generating the
|
|
shell completions, especially, since they are generated by Cobra itself
|
|
and podman(1) is not involved at all.
|
|
|
|
Note that podman(1) is needed when the generated shell completions are
|
|
actually used in interactive command line environments. The shell
|
|
completions invoke the hidden '__complete' command to get the results
|
|
that are presented to the user, and, if needed, 'podman system migrate'
|
|
will continue to be run as part of that.
|
|
|
|
This partially reverts commit f3e005d0142d7ec76d5ac8f0a2f331a52fd46011
|
|
because podman(1) is now only an optional runtime dependency for the
|
|
system tests.
|
|
|
|
https://github.com/containers/podman/issues/17657
|
|
---
|
|
meson.build | 2 +-
|
|
src/cmd/root.go | 9 +++++++--
|
|
2 files changed, 8 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/meson.build b/meson.build
|
|
index 6f044bb204e3..653a3d3ac588 100644
|
|
--- a/meson.build
|
|
+++ b/meson.build
|
|
@@ -18,12 +18,12 @@ subid_dep = cc.find_library('subid', has_headers: ['shadow/subid.h'])
|
|
|
|
go = find_program('go')
|
|
go_md2man = find_program('go-md2man')
|
|
-podman = find_program('podman')
|
|
|
|
bats = find_program('bats', required: false)
|
|
codespell = find_program('codespell', required: false)
|
|
htpasswd = find_program('htpasswd', required: false)
|
|
openssl = find_program('openssl', required: false)
|
|
+podman = find_program('podman', required: false)
|
|
shellcheck = find_program('shellcheck', required: false)
|
|
skopeo = find_program('skopeo', required: false)
|
|
|
|
diff --git a/src/cmd/root.go b/src/cmd/root.go
|
|
index 304b03dcd889..9975ccc7a4c8 100644
|
|
--- a/src/cmd/root.go
|
|
+++ b/src/cmd/root.go
|
|
@@ -166,7 +166,7 @@ func preRun(cmd *cobra.Command, args []string) error {
|
|
|
|
logrus.Debugf("TOOLBOX_PATH is %s", toolboxPath)
|
|
|
|
- if err := migrate(); err != nil {
|
|
+ if err := migrate(cmd, args); err != nil {
|
|
return err
|
|
}
|
|
|
|
@@ -211,13 +211,18 @@ func rootRun(cmd *cobra.Command, args []string) error {
|
|
return rootRunImpl(cmd, args)
|
|
}
|
|
|
|
-func migrate() error {
|
|
+func migrate(cmd *cobra.Command, args []string) error {
|
|
logrus.Debug("Migrating to newer Podman")
|
|
|
|
if utils.IsInsideContainer() {
|
|
return nil
|
|
}
|
|
|
|
+ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName {
|
|
+ logrus.Debugf("Migration not needed: command %s doesn't need it", cmdName)
|
|
+ return nil
|
|
+ }
|
|
+
|
|
configDir, err := os.UserConfigDir()
|
|
if err != nil {
|
|
logrus.Debugf("Migrating to newer Podman: failed to get the user config directory: %s", err)
|
|
--
|
|
2.39.1
|
|
|