Lock subPath volumes

Browse Source

Users must not be allowed to step outside the volume with subPath.
Therefore the final subPath directory must be "locked" somehow
and checked if it's inside volume.

On Windows, we lock the directories. On Linux, we bind-mount the final
subPath into /var/lib/kubelet/pods/<uid>/volume-subpaths/<container name>/<subPathName>,
it can't be changed to symlink user once it's bind-mounted.

...

This commit is contained in:

Jan Safranek

2018-03-05 09:14:44 +01:00

parent c6d0726df8

commit 5110db5087

34 changed files with 2775 additions and 73 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

1206

pkg/util/mount/mount_linux_test.go

File diff suppressed because it is too large Load Diff