Skip to content

pkg/machine: add custom policy.json logic #21765

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Feb 27, 2024
Merged

pkg/machine: add custom policy.json logic #21765

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a02aa8f
pkg/machine/ocipull: add custom policy.json location
Luap99 Feb 20, 2024
f5a2683
Makefile: add MACHINE_POLICY_JSON_DIR option
Luap99 Feb 20, 2024
bed6180
pkg/machine/ocipull: add default policy.json file
Luap99 Feb 20, 2024
1e5b5a8
macos installer: install default policy.json file
Luap99 Feb 20, 2024
e32c9bb
Makefile: add machine policy.json to podman-remote.zip
Luap99 Feb 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,7 @@ LDFLAGS_PODMAN ?= \
-X $(LIBPOD)/config._installPrefix=$(PREFIX) \
-X $(LIBPOD)/config._etcDir=$(ETCDIR) \
-X $(PROJECT)/v5/pkg/systemd/quadlet._binDir=$(BINDIR) \
-X $(PROJECT)/v5/pkg/machine/ocipull.DefaultPolicyJSONPath=$(MACHINE_POLICY_JSON_DIR) \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like during the pkginstaller build, $(MACHINE_POLICY_JSON_DIR) isn't passed from package.sh for some reason.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for checking, yes the quoting in package.sh was incorrect please retry

-X github.com/containers/common/pkg/config.additionalHelperBinariesDir=$(HELPER_BINARIES_DIR)\
$(EXTRA_LDFLAGS)
LDFLAGS_PODMAN_STATIC ?= \
Expand Down Expand Up @@ -762,10 +763,10 @@ podman-remote-release-%.zip: test/version/version ## Build podman-remote for %=$
$(MAKE) GOOS=$(GOOS) GOARCH=$(GOARCH) \
clean-binaries podman-remote-$(GOOS)-docs
if [[ "$(GOARCH)" != "$(NATIVE_GOARCH)" ]]; then \
$(MAKE) CGO_ENABLED=0 $(GOPLAT) BUILDTAGS="$(BUILDTAGS_CROSS)" \
$(MAKE) CGO_ENABLED=0 $(GOPLAT) BUILDTAGS="$(BUILDTAGS_CROSS)" MACHINE_POLICY_JSON_DIR="." \
clean-binaries podman-remote; \
else \
$(MAKE) $(GOPLAT) podman-remote; \
$(MAKE) $(GOPLAT) MACHINE_POLICY_JSON_DIR="." podman-remote; \
Copy link
Member

@n1hility n1hility Feb 24, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note this is going to apply this setting to all machine zip archives whether darwin/win/linux etc, which is probably not what you want.

One other approach that could make the Makefile approach a bit easier is to move LDFLAGS_PODMAN down to be after the os check area where SRCBINDIR is defined, and use that to also set MACHINE_POLICY_JSON_DIR defaults.

Or you could this code wise and just change the logic in policyPath with a func in _windows.go that ignores the build flag and just uses a hard coded constant.

If you prefer I can also just address this aspect in the follow-up PR change that also updates the installer.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note this is going to apply this setting to all machine zip archives whether darwin/win/linux etc, which is probably not what you want.

Why not? If you run from the zip we should not assume any hard coded locations so I think that is fine regardless of the OS that they are used on.

I rather not hard code the default into the binary only for windows as this should really left to packagers IMO.

Copy link
Member

@n1hility n1hility Feb 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah ok fair enough, I assumed you wanted something like ../../conf on linux but I agree no reason it can't all be the same.

There is one remaining issue which is that right now the policy is placed in the root, yet the binary is placed in usr/bin. For this strategy to work with the zips we would need to put the policy in /usr/bin, or alternatively we could do a search order, first check same dir, then fall back to ../..

fi
if [[ "$(GOOS)" == "windows" ]]; then \
$(MAKE) $(GOPLAT) TMPDIR="" win-gvproxy; \
Expand All @@ -775,6 +776,7 @@ podman-remote-release-%.zip: test/version/version ## Build podman-remote for %=$
fi
cp -r ./docs/build/remote/$(GOOS) "$(tmpsubdir)/$(releasedir)/docs/"
cp ./contrib/remote/containers.conf "$(tmpsubdir)/$(releasedir)/"
cp ./pkg/machine/ocipull/policy.json "$(tmpsubdir)/$(releasedir)/"
$(MAKE) $(GOPLAT) $(_dstargs) SELINUXOPT="" install.remote
cd "$(tmpsubdir)" && \
zip --recurse-paths "$(CURDIR)/$@" "./$(releasedir)"
Expand Down
2 changes: 2 additions & 0 deletions contrib/pkginstaller/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,8 @@ package_root: clean-pkgroot $(TMP_DOWNLOAD)/gvproxy $(TMP_DOWNLOAD)/vfkit
cp $(TMP_DOWNLOAD)/gvproxy $(PACKAGE_ROOT)/podman/bin/
cp $(TMP_DOWNLOAD)/vfkit $(PACKAGE_ROOT)/podman/bin/
chmod a+x $(PACKAGE_ROOT)/podman/bin/*
mkdir $(PACKAGE_ROOT)/podman/config
cp ../../pkg/machine/ocipull/policy.json $(PACKAGE_ROOT)/podman/config/policy.json

%: %.in podman_version
@sed -e 's/__VERSION__/'$(shell ../../test/version/version)'/g' $< >$@
Expand Down
3 changes: 2 additions & 1 deletion contrib/pkginstaller/package.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ CODESIGN_IDENTITY=${CODESIGN_IDENTITY:-mock}
PRODUCTSIGN_IDENTITY=${PRODUCTSIGN_IDENTITY:-mock}
NO_CODESIGN=${NO_CODESIGN:-0}
HELPER_BINARIES_DIR="/opt/podman/bin"
MACHINE_POLICY_JSON_DIR="/opt/podman/config"

binDir="${BASEDIR}/root/podman/bin"

Expand All @@ -16,7 +17,7 @@ arch=$(cat "${BASEDIR}/ARCH")

function build_podman() {
pushd "$1"
make GOARCH="${goArch}" podman-remote HELPER_BINARIES_DIR="${HELPER_BINARIES_DIR}"
make GOARCH="${goArch}" podman-remote HELPER_BINARIES_DIR="${HELPER_BINARIES_DIR}" MACHINE_POLICY_JSON_DIR="${MACHINE_POLICY_JSON_DIR}"
make GOARCH="${goArch}" podman-mac-helper
cp bin/darwin/podman "contrib/pkginstaller/out/packaging/${binDir}/podman"
cp bin/darwin/podman-mac-helper "contrib/pkginstaller/out/packaging/${binDir}/podman-mac-helper"
Expand Down
47 changes: 47 additions & 0 deletions pkg/machine/ocipull/policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
package ocipull

import (
"fmt"
"os"
"path/filepath"
)

// DefaultPolicyJSONPath should be overwritten at build time with the real path to the directory where
// the shipped policy.json file is located. This can either be absolute path or a relative path. If it
// is relative it will be resolved relative to the podman binary and NOT the CWD.
//
// use "-X github.com/containers/podman/v5/pkg/machine/ocipull.DefaultPolicyJSONPath=/somepath" in go ldflags to overwrite this
var DefaultPolicyJSONPath = ""

const policyfile = "policy.json"

type defaultPolicyError struct {
errs []error
}

func (e *defaultPolicyError) Error() string {
return fmt.Sprintf("no DefaultPolicyJSONPath defined and no local overwrites found: %q", e.errs)
}

func policyPath() (string, error) {
paths := localPolicyOverwrites()
errs := make([]error, 0, len(paths))
for _, path := range paths {
_, err := os.Stat(path)
if err == nil {
return path, nil
}
errs = append(errs, err)
}
if DefaultPolicyJSONPath != "" {
if filepath.IsAbs(DefaultPolicyJSONPath) {
return filepath.Join(DefaultPolicyJSONPath, policyfile), nil
}
p, err := os.Executable()
if err != nil {
return "", fmt.Errorf("could not resolve relative path to binary: %w", err)
}
return filepath.Join(p, DefaultPolicyJSONPath, policyfile), nil
}
return "", &defaultPolicyError{errs: errs}
}
7 changes: 7 additions & 0 deletions pkg/machine/ocipull/policy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
{
"default": [
{
"type": "insecureAcceptAnything"
}
]
}
19 changes: 19 additions & 0 deletions pkg/machine/ocipull/policy_unix.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
//go:build !windows

package ocipull

import (
"path/filepath"

"github.com/containers/common/pkg/config"
"github.com/containers/storage/pkg/homedir"
)

func localPolicyOverwrites() []string {
var dirs []string
if p, err := homedir.GetConfigHome(); err == nil {
dirs = append(dirs, filepath.Join(p, "containers", policyfile))
}
dirs = append(dirs, config.DefaultSignaturePolicyPath)
return dirs
}
10 changes: 10 additions & 0 deletions pkg/machine/ocipull/policy_windows.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
package ocipull

import (
"os"
"path/filepath"
)

func localPolicyOverwrites() []string {
return []string{filepath.Join(os.Getenv("APPDATA"), "containers", policyfile)}
}
9 changes: 7 additions & 2 deletions pkg/machine/ocipull/pull.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,14 @@ func Pull(ctx context.Context, imageInput types.ImageReference, localDestPath *d
sysCtx.DockerAuthConfig = authConf
}

policy, err := signature.DefaultPolicy(sysCtx)
path, err := policyPath()
if err != nil {
return fmt.Errorf("obtaining default signature policy: %w", err)
return err
}

policy, err := signature.NewPolicyFromFile(path)
if err != nil {
return fmt.Errorf("obtaining signature policy: %w", err)
}
policyContext, err := signature.NewPolicyContext(policy)
if err != nil {
Expand Down