rootless: check uid with Geteuid() instead of Getuid()

change the tests to use chroot to set a numeric UID/GID.

Go syscall.Credential doesn't change the effective UID/GID of the
process.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Closes: #1372
Approved by: mheon

cmd/podman/create.go

@@ -99,7 +99,7 @@ func createCmd(c *cli.Context) error {
 	storageOpts.UIDMap = mappings.UIDMap
 	storageOpts.GIDMap = mappings.GIDMap
 
-	if os.Getuid() != 0 {
+	if os.Geteuid() != 0 {
 		rootless.SetSkipStorageSetup(true)
 	}
 
@@ -778,7 +778,7 @@ func parseCreateOpts(ctx context.Context, c *cli.Context, runtime *libpod.Runtim
 }
 
 func joinOrCreateRootlessUserNamespace(createConfig *cc.CreateConfig, runtime *libpod.Runtime) (bool, int, error) {
-	if os.Getuid() == 0 {
+	if os.Geteuid() == 0 {
 		return false, 0, nil
 	}
 

cmd/podman/pause.go

@@ -26,7 +26,7 @@ var (
 )
 
 func pauseCmd(c *cli.Context) error {
-	if os.Getuid() != 0 {
+	if os.Geteuid() != 0 {
 		return errors.New("pause is not supported for rootless containers")
 	}
 

cmd/podman/run.go

@@ -74,7 +74,7 @@ func runCmd(c *cli.Context) error {
 	storageOpts.UIDMap = mappings.UIDMap
 	storageOpts.GIDMap = mappings.GIDMap
 
-	if os.Getuid() != 0 {
+	if os.Geteuid() != 0 {
 		rootless.SetSkipStorageSetup(true)
 	}
 

cmd/podman/stats.go

@@ -64,7 +64,7 @@ func statsCmd(c *cli.Context) error {
 		return err
 	}
 
-	if os.Getuid() != 0 {
+	if os.Geteuid() != 0 {
 		return errors.New("stats is not supported for rootless containers")
 	}
 

cmd/podman/unpause.go

@@ -26,7 +26,7 @@ var (
 )
 
 func unpauseCmd(c *cli.Context) error {
-	if os.Getuid() != 0 {
+	if os.Geteuid() != 0 {
 		return errors.New("unpause is not supported for rootless containers")
 	}
 

libpod/oci_linux.go

@@ -20,7 +20,7 @@ import (
 )
 
 func (r *OCIRuntime) moveConmonToCgroup(ctr *Container, cgroupParent string, cmd *exec.Cmd) error {
-	if os.Getuid() == 0 {
+	if os.Geteuid() == 0 {
 		if r.cgroupManager == SystemdCgroupsManager {
 			unitName := createUnitName("libpod-conmon", ctr.ID())
 

libpod/runtime.go

@@ -561,7 +561,7 @@ func makeRuntime(runtime *Runtime) (err error) {
 		// empty state only creates a single file
 		// As such, it's not really a performance concern
 		if os.IsNotExist(err) {
-			if os.Getuid() != 0 {
+			if os.Geteuid() != 0 {
 				aliveLock.Unlock()
 				locked = false
 				if err2 := runtime.refreshRootless(); err2 != nil {

pkg/rootless/rootless_linux.c

@@ -107,6 +107,10 @@ reexec_userns_join (int userns)
     _exit (EXIT_FAILURE);
   close (userns);
 
+  if (setresgid (0, 0, 0) < 0 ||
+      setresuid (0, 0, 0) < 0)
+    _exit (EXIT_FAILURE);
+
   execvp (argv[0], argv);
 
   _exit (EXIT_FAILURE);

pkg/rootless/rootless_linux.go

@@ -34,7 +34,7 @@ func runInUser() error {
 
 // IsRootless tells us if we are running in rootless mode
 func IsRootless() bool {
-	return os.Getuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != ""
+	return os.Geteuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != ""
 }
 
 var (
@@ -88,7 +88,7 @@ func tryMappingTool(tool string, pid int, hostID int, mappings []idtools.IDMap)
 // JoinNS re-exec podman in a new userNS and join the user namespace of the specified
 // PID.
 func JoinNS(pid uint) (bool, int, error) {
-	if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
+	if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
 		return false, -1, nil
 	}
 
@@ -116,7 +116,7 @@ func JoinNS(pid uint) (bool, int, error) {
 // If podman was re-executed the caller needs to propagate the error code returned by the child
 // process.
 func BecomeRootInUserNS() (bool, int, error) {
-	if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
+	if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
 		if os.Getenv("_LIBPOD_USERNS_CONFIGURED") == "init" {
 			return false, 0, runInUser()
 		}
@@ -142,7 +142,7 @@ func BecomeRootInUserNS() (bool, int, error) {
 	var uids, gids []idtools.IDMap
 	username := os.Getenv("USER")
 	if username == "" {
-		user, err := user.LookupId(fmt.Sprintf("%d", os.Geteuid()))
+		user, err := user.LookupId(fmt.Sprintf("%d", os.Getuid()))
 		if err != nil && os.Getenv("PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS") == "" {
 			return false, 0, errors.Wrapf(err, "could not find user by UID nor USER env was set")
 		}

test/e2e/libpod_suite_test.go

@@ -10,7 +10,6 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
-	"syscall"
 	"testing"
 	"time"
 
@@ -190,11 +189,13 @@ func (p *PodmanTest) PodmanAsUser(args []string, uid, gid uint32, env []string)
 	} else {
 		fmt.Printf("Running: (env: %v) %s %s\n", env, p.PodmanBinary, strings.Join(podmanOptions, " "))
 	}
-	command := exec.Command(p.PodmanBinary, podmanOptions...)
+	var command *exec.Cmd
 
 	if uid != 0 || gid != 0 {
-		command.SysProcAttr = &syscall.SysProcAttr{}
+		nsEnterOpts := append([]string{"--userspec", fmt.Sprintf("%d:%d", uid, gid), "/", p.PodmanBinary}, podmanOptions...)
-		command.SysProcAttr.Credential = &syscall.Credential{Uid: uid, Gid: gid}
+		command = exec.Command("chroot", nsEnterOpts...)
+	} else {
+		command = exec.Command(p.PodmanBinary, podmanOptions...)
 	}
 	if env != nil {
 		command.Env = env