Bug 852216

Summary:	zend /sandbox should be root owned if possible
Product:	OKD	Reporter:	Mike McGrath <mmcgrath>
Component:	Containers	Assignee:	Ram Ranganathan <ramr>
Status:	CLOSED CURRENTRELEASE	QA Contact:	libra bugs <libra-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	2.x	CC:	bmeng, mfisher, mpatel
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-09-17 21:29:35 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mike McGrath 2012-08-27 21:36:44 UTC

Stuff in /sandbox should be owned by the cartridge and should probably be fully namespaced to avoid collisions in the future.

If the user goes and changes stuff in /sandbox/ that means we can't make any assumptions about it when doing migrations and it might make migrations impossible in the future.

Comment 1 Mike McGrath 2012-08-27 21:43:10 UTC

actually a follow up on this, /sandbox/zend/ is probably the correct namespace.  We're deprecating the cartridge-version spacing in the new cartridge style.  It should still be root owned though.

Comment 2 Meng Bo 2012-08-28 07:46:44 UTC

Currently, the /sandbox is owned by user.

[zend-bmengdev.dev.rhcloud.com ~]\> ls -Zd /sandbox/
drwxrwxrwt. e46b1387514546769fb1e8e46b762033 root system_u:object_r:libra_tmp_t:s0:c0,c537 /sandbox/

Comment 3 Meng Bo 2012-09-03 09:43:00 UTC

Checked on latest devenv_2108, the /sandbox is still user owned.

[zend-bmengdev.dev.rhcloud.com ~]\> ls -Zd /sandbox/
drwxrwxrwt. 804e89dd57d34b998941cf5e16e2ff71 root system_u:object_r:libra_tmp_t:s0:c0,c501 /sandbox/

Comment 4 Ram Ranganathan 2012-09-05 02:30:17 UTC

Fixed with pull requests: 
https://github.com/openshift/crankcase/pull/452
https://github.com/openshift/li/pull/342

waiting for merge+test.

/sandbox is root owned.

Comment 5 Meng Bo 2012-09-05 07:48:19 UTC

Checked on devenv_2114, issue has been fixed. 
/sandbox is root owned.

[zend-bmengdev.dev.rhcloud.com ~]\> ls -Zd /sandbox/
drwxr-xr-t. root root unconfined_u:object_r:libra_tmp_t:s0:c0,c1001 /sandbox/