3 Commits

Author	SHA1	Message	Date
Jan Safranek	9f80de3772	Split NsEnterMounter and Mounter implementation of doBindSubpath ... nsenter implementation needs to mount different thing in the end and do different checks on the result.	2018-05-23 10:21:21 +02:00
Jan Safranek	5110db5087	Lock subPath volumes ... Users must not be allowed to step outside the volume with subPath. Therefore the final subPath directory must be "locked" somehow and checked if it's inside volume. On Windows, we lock the directories. On Linux, we bind-mount the final subPath into /var/lib/kubelet/pods/<uid>/volume-subpaths/<container name>/<subPathName>, it can't be changed to symlink user once it's bind-mounted.	2018-03-05 09:14:44 +01:00
Jan Safranek	87551071a1	Fix findmnt parsing in containerized kubelet ... NsEnterMounter should not stop parsing findmnt output on the first space but on the last one, just in case the mount point name itself contains a space.	2017-07-18 13:35:44 +02:00