Function prepareBundleDirectoryPermissions

core/runtime/v2/bundle_linux.go:30–42

prepareBundleDirectoryPermissions prepares the permissions of the bundle directory according to the needs of the current platform. On Linux when user namespaces are enabled, the permissions are modified to allow the remapped root GID to access the bundle.

(path string, spec []byte)

// On Linux when user namespaces are enabled, the permissions are modified to
// allow the remapped root GID to access the bundle.
func prepareBundleDirectoryPermissions(path string, spec []byte) error {
	gid, err := remappedGID(spec)
	if err != nil {
		return err
	}
	if gid == 0 {
		return nil
	}
	if err := os.Chown(path, -1, int(gid)); err != nil {
		return err
	}
	return os.Chmod(path, 0710)
}

// ociSpecUserNS is a subset of specs.Spec used to reduce garbage during
// unmarshal.