chanegd permissions after re-creating a char device under /dev
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- c, linux
- Domain
- operating-systems, security
Research direction
Start by reproducing the issue with --dev-bind /dev/steve /dev/steve, first with the existing device and then after the host recreates it through the shown udev rule. Trace how bubblewrap handles the device bind and permission state; done means the recreated device retains the intended steve:jobserver ownership and 660 mode inside the image.
Written by the indexing model from the issue text.
Description
A
--dev-bind /dev/steve /dev/steve
gives for an existing device /dev/steve the right permissions within an image:
crw-rw---- 1 steve jobserver 247, 0 Dec 20 09:34 /dev/steve
But if the jobserver at the host is restarted, then the device will be recreated there. The udev rules
# cat /etc/udev/rules.d/99-steve.rules
ACTION=="add", ENV{DEVNAME}=="/dev/steve", OWNER="steve", GROUP="jobserver", MODE="660"
ensures right perms after restart at the host. But for bubblewraped images the permissions within the image are set to user root now.
- Dominant language
- C
- Stars
- 8.9k
- Forks
- 391
- Avg merge
- 1d 32m
- Merged PRs (30d)
- 7
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from containers/bubblewrap
-
README: writable --bind paths are not isolated from hardlinks created outside the sandboxPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
containers/bubblewrap#813 · 3 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
containers/bubblewrap#767 · 2 comments ·
Maintainers usually reply within 1 day
-
Related project comparisons in README.md are outdatedMay be free again A pull request for this issue was closed without being merged. Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
containers/bubblewrap#743 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
containers/bubblewrap#298 · 4 comments · 5 reactions ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
containers/bubblewrap#811 ·
Maintainers usually reply within 1 day
All issues in containers/bubblewrap
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
compiler-explorer/compiler-explorer#9272 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
semantic-reasoning/wirelog#2163 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
Xinyuan-LilyGO/T-Display-S3#352 · 3 comments ·
-
documentation severity/minor
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day