{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/image-tools/issues/3","repository_url":"https://api.github.com/repos/opencontainers/image-tools","labels_url":"https://api.github.com/repos/opencontainers/image-tools/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/image-tools/issues/3/comments","events_url":"https://api.github.com/repos/opencontainers/image-tools/issues/3/events","html_url":"https://github.com/opencontainers/image-tools/pull/3","id":177236228,"number":3,"title":"Apply ownership in unpacked entries","user":{"login":"glestaris","id":1753414,"avatar_url":"https://avatars.githubusercontent.com/u/1753414?v=3","gravatar_id":"","url":"https://api.github.com/users/glestaris","html_url":"https://github.com/glestaris","followers_url":"https://api.github.com/users/glestaris/followers","following_url":"https://api.github.com/users/glestaris/following{/other_user}","gists_url":"https://api.github.com/users/glestaris/gists{/gist_id}","starred_url":"https://api.github.com/users/glestaris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glestaris/subscriptions","organizations_url":"https://api.github.com/users/glestaris/orgs","repos_url":"https://api.github.com/users/glestaris/repos","events_url":"https://api.github.com/users/glestaris/events{/privacy}","received_events_url":"https://api.github.com/users/glestaris/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":42,"created_at":"2016-09-15T17:24:52Z","updated_at":"2016-10-03T22:11:10Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/opencontainers/image-tools/pulls/3","html_url":"https://github.com/opencontainers/image-tools/pull/3","diff_url":"https://github.com/opencontainers/image-tools/pull/3.diff","patch_url":"https://github.com/opencontainers/image-tools/pull/3.patch"},"body":"This patch will apply the user/group, found in the tar entry, to the unpacked\r\nfiles, directories, and symlinks. It will only do so if the user running the\r\n`oci-unpack` tool is root.\r\n\r\nTo test the patch, I used latest Ubuntu from Dockerhub, converted to OCI\r\nformat with `skopeo`:\r\n\r\n```bash\r\nskopeo copy docker://ubuntu oci://$PWD/ubuntu\r\n```\r\n\r\nWith the current `oci-unpack`, all files and directories are owned by the user\r\nthat does the unpacking:\r\n\r\n```bash\r\nroot@vagrant:/tmp# ls -la ubuntu-unpacked-old/etc/shadow\r\n-rw-r----- 1 root root 652 Sep 15 17:17 ubuntu-unpacked-old/etc/shadow\r\n```\r\n\r\nWith the proposed patch, the correct ownership is applied:\r\n\r\n```bash\r\nroot@vagrant:/tmp# ls -la ubuntu-unpacked/etc/shadow\r\n-rw-r----- 1 root shadow 652 Sep 15 17:14 ubuntu-unpacked/etc/shadow\r\n```"},"comment":{"url":"https://api.github.com/repos/opencontainers/image-tools/issues/comments/251242375","html_url":"https://github.com/opencontainers/image-tools/pull/3#issuecomment-251242375","issue_url":"https://api.github.com/repos/opencontainers/image-tools/issues/3","id":251242375,"user":{"login":"wking","id":209920,"avatar_url":"https://avatars.githubusercontent.com/u/209920?v=3","gravatar_id":"","url":"https://api.github.com/users/wking","html_url":"https://github.com/wking","followers_url":"https://api.github.com/users/wking/followers","following_url":"https://api.github.com/users/wking/following{/other_user}","gists_url":"https://api.github.com/users/wking/gists{/gist_id}","starred_url":"https://api.github.com/users/wking/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wking/subscriptions","organizations_url":"https://api.github.com/users/wking/orgs","repos_url":"https://api.github.com/users/wking/repos","events_url":"https://api.github.com/users/wking/events{/privacy}","received_events_url":"https://api.github.com/users/wking/received_events","type":"User","site_admin":false},"created_at":"2016-10-03T22:11:10Z","updated_at":"2016-10-03T22:11:10Z","body":"On Mon, Oct 03, 2016 at 02:50:44PM -0700, Aleksa Sarai wrote:\n> Case 2 actually can also involve when you have a mapping which is\n> smaller than the number of UIDs used within the image -- which is\n> sort of a mix between case 1 and case 2…\n\nSo for a given UID there are three cases:\n\n1. It's mapped in the current user namespace, and the caller has\n   permission to chown files to that UID.\n2. It's mapped in the current user namespace, and the caller does not\n   have permission to chown files to that UID.\n3. It's not mapped in the current user namespace.\n\nBut I don't think we need much special handling beyond 7d9350e for\nthis.  When sameOwner is set, we'll fail with a chown permission error\non either 2 or 3.  When sameOwner is not set, you're fine because\nyou're never calling chown.\n\nThe only thing I think we're missing is a --no-same-owner, which you\ncould use to avoid erroring if the tarball contained instances of 2.\nIf you don't have enough local UIDs to cover the tarball's needs, I\ndon't see a point in gracefully degrading (how would you know which\nIDs to flatten?).  You could provide switches to explicitly control\nthe mapping, but I'd rather avoid that complication and jump straight\nto a single user filesystem.  In practice, I expect it will be rare\nthat a user has a multiple available UIDs but not enough to cover the\ncontainer.\n"}}
{"actor":{"display_login":"wking"}}