opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-12-01 10:38:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

libpod: hasCurrentUserMapped checks for gid too

Browse Source 
the kernel checks that both the uid and the gid are mapped inside the
user namespace, not only the uid:

/**
 * privileged_wrt_inode_uidgid - Do capabilities in the namespace work over the inode?
 * @ns: The user namespace in question
 * @idmap: idmap of the mount @inode was found from
 * @inode: The inode in question
 *
 * Return true if the inode uid and gid are within the namespace.
 */
bool privileged_wrt_inode_uidgid(struct user_namespace *ns,
				 struct mnt_idmap *idmap,
				 const struct inode *inode)
{
	return vfsuid_has_mapping(ns, i_uid_into_vfsuid(idmap, inode)) &&
	       vfsgid_has_mapping(ns, i_gid_into_vfsgid(idmap, inode));
}

for this reason, improve the check for hasCurrentUserMapped to verify
that the gid is also mapped, and if it is not, use an intermediate
mount for the container rootfs.

Closes: https://github.com/containers/podman/issues/24159

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2024-10-04 16:09:54 +02:00
parent 08cbd38994
commit e46ae46f18
2 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
test/system/170-run-userns.bats
View File

@@ -169,3 +169,15 @@ EOF
run_podman run --rm --userns=auto:uidmapping=$mapping $IMAGE awk '{if($1 == 1){print $2}}' /proc/self/uid_map
assert "$output" == 1
}
# bats test_tags=ci:parallel
@test "podman current user not mapped in the userns" {
# both uid and gid not mapped
run_podman run --rm --uidmap 0:1:1000 $IMAGE true
# uid not mapped
run_podman run --rm --uidmap 0:1:1000 --gidmap 0:0:1000 $IMAGE true
# gid not mapped
run_podman run --rm --uidmap 0:0:1000 --gidmap 0:1:1000 $IMAGE true
}