scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-11-04 04:08:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix subPath existence check to not follow symlink

Browse Source 
Volume mounting logic introduced in #43775 and #45623 checks
for subPath existence before attempting to create a directory,
should subPath not be present.

This breaks if subPath is a dangling symlink, os.Stat returns
"do not exist" status, yet `os.MkdirAll` can't create directory
as symlink is present at the given path.

This patch makes existence check to use os.Lstat which works for
normal files/directories as well as doesn't not attempt to follow
symlink, therefore it's "do not exist" status is more reliable when
making a decision whether to create directory or not.

subPath symlinks can be dangling in situations where kubelet is
running in a container itself with access to docker socket, such
as CoreOS's kubelet-wrapper script
This commit is contained in:
Maxim Ivanov
2017-07-06 17:46:17 +01:00
parent b9e8d2aee6
commit 020ec43b56
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/kubelet/kubelet_pods.go
View File

@@ -146,7 +146,7 @@ func makeMounts(pod *v1.Pod, podDir string, container *v1.Container, hostName, h
hostPath = filepath.Join(hostPath, mount.SubPath) hostPath = filepath.Join(hostPath, mount.SubPath)
if subPathExists, err := util.FileExists(hostPath); err != nil { if subPathExists, err := util.FileOrSymlinkExists(hostPath); err != nil {
glog.Errorf("Could not determine if subPath %s exists; will not attempt to change its permissions", hostPath) glog.Errorf("Could not determine if subPath %s exists; will not attempt to change its permissions", hostPath)
} else if !subPathExists { } else if !subPathExists {
// Create the sub path now because if it's auto-created later when referenced, it may have an // Create the sub path now because if it's auto-created later when referenced, it may have an

9
pkg/util/util.go
View File

@@ -84,6 +84,15 @@ func FileExists(filename string) (bool, error) {
return true, nil return true, nil
} }
func FileOrSymlinkExists(filename string) (bool, error) {
if _, err := os.Lstat(filename); os.IsNotExist(err) {
return false, nil
} else if err != nil {
return false, err
}
return true, nil
}
// ReadDirNoStat returns a string of files/directories contained // ReadDirNoStat returns a string of files/directories contained
// in dirname without calling lstat on them. // in dirname without calling lstat on them.
func ReadDirNoStat(dirname string) ([]string, error) { func ReadDirNoStat(dirname string) ([]string, error) {