File permissions ignored when running in Docker
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 240
- Forks
- 60
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 1
Description
When running msys2 inside Docker, it seems to incorrectly read the permissions of the underling filesystem.
Uses icacls on Windows to modify file/folder permissions, these commands work as expected, and set the permissions in the filesystem, which can be verified as set using icacls.
Things change once docker is brought into the mix:
| Host | Docker using volume mount | Docker non-mount | |
|---|---|---|---|
| Powershell | > icacls foo /deny Everyone:r > Get-Content foo Get-Content: Access to the path 'D:\tmp\msysperms\foo' is denied |
> Get-Content foo foo |
> icacls foo /deny Everyone:r > Get-Content foo Get-Content : Access to the path 'C:\msysperms2\foo' is denied |
| MSYS | $ cat foo cat: foo: Permission denied |
# cat foo foo |
# cat foo ▒▒foo |
This seems like it might be related to #59, but also could be upstream in the Docker volume system, as both inside and outside msys2 ignore permissions in that case.
I think I did the above tests using Hyper-V isolation, but I've seen the problem when using volume mounts with process isolation too (process isolation mitigates #59). This is also using the ContainerAdministrator account, I haven't tested with the ContainerUser account, but on a normal system running as admin the read is still blocked.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the reported matrix with icacls, MSYS cat, Docker volume mounts, and non-mount containers under Hyper-V and process isolation. Compare the permission behavior inside and outside MSYS2, including ContainerAdministrator and ContainerUser if possible, then determine whether the fix belongs in msys2-runtime or the Docker volume system. Done means the permission denial is consistently honored for the affected volume scenario.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, docker
- Domain
- infrastructure, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100