diff options
| author | Lokesh Mandvekar <lsm5@fedoraproject.org> | 2023-06-14 14:49:08 -0400 |
|---|---|---|
| committer | Lokesh Mandvekar <lsm5@fedoraproject.org> | 2023-06-15 08:14:12 -0400 |
| commit | 3efaffae43cb165092dedf2c8d20a9c8e59194df (patch) | |
| tree | 48e6fab033e0090b7ce684f9ebc93cc82e470d4e /rpm | |
| parent | 5b5b1cc4e224731b237f7343e987951bcc353d47 (diff) | |
New command: podmansh
This commit creates a new command `podmansh` command which can be used by
administrators to provide a confined shell to their users.
The user will only have access to the volumes and capabilities for that
user.
Co-authored-by: Paul Holzinger <pholzing@redhat.com>
Co-authored-by: Daniel Walsh <dwalsh@redhat.com>
Co-authored-by: Petr Lautrbach <lautrbach@redhat.com>
Co-authored-by: Ed Santiago <santiago@redhat.com>
Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
Diffstat (limited to 'rpm')
| -rw-r--r-- | rpm/podman.spec | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/rpm/podman.spec b/rpm/podman.spec index 042fd2915..69d7143e7 100644 --- a/rpm/podman.spec +++ b/rpm/podman.spec @@ -241,6 +241,19 @@ It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. +%package -n %{name}sh +Summary: Confined login and user shell using %{name} +Requires: %{name} = %{epoch}:%{version}-%{release} +Provides: %{name}-shell = %{epoch}:%{version}-%{release} +Provides: %{name}-%{name}sh = %{epoch}:%{version}-%{release} + +%description -n %{name}sh +%{name}sh provides a confined login and user shell with access to volumes and +capabilities specified in user quadlets. + +It is a symlink to %{_bindir}/%{name} and execs into the `%{name}sh` container +when `%{_bindir}/%{name}sh is set as a login shell or set as os.Args[0]. + %prep %autosetup -Sgit -n %{name}-%{version} sed -i 's;@@PODMAN@@\;$(BINDIR);@@PODMAN@@\;%{_bindir};' Makefile @@ -414,6 +427,11 @@ cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/ %{_libexecdir}/%{name}/gvproxy %{_libexecdir}/%{name}/gvforwarder +%files -n %{name}sh +%license LICENSE +%doc README.md CONTRIBUTING.md install.md transfer.md +%{_bindir}/%{name}sh + %changelog %if %{with changelog} * Mon May 01 2023 RH Container Bot <rhcontainerbot@fedoraproject.org> |