opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-07-15 03:02:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7162 from giuseppe/add-rootless-checks

Browse Source 
rootless: do not ignore errors if mappings are specified
This commit is contained in:
OpenShift Merge Robot
2020-07-31 06:16:14 -04:00
committed by GitHub
parent 0e009d5f80 d188b2fe22
commit e911875b6a
2 changed files with 31 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/rootless/rootless_linux.c
View File

@ -860,7 +860,7 @@ reexec_in_user_namespace (int ready, char *pause_pid_file_path, char *file_to_re
fprintf (stderr, "cannot read from sync pipe: %s\n", strerror (errno)); fprintf (stderr, "cannot read from sync pipe: %s\n", strerror (errno));
_exit (EXIT_FAILURE); _exit (EXIT_FAILURE);
} }
if (b != '0') if (ret != 1 || b != '0')
_exit (EXIT_FAILURE); _exit (EXIT_FAILURE);
if (syscall_setresgid (0, 0, 0) < 0) if (syscall_setresgid (0, 0, 0) < 0)

35
pkg/rootless/rootless_linux.go
View File

@ -97,7 +97,11 @@ func GetRootlessGID() int {
return os.Getegid() return os.Getegid()
} }
func tryMappingTool(tool string, pid int, hostID int, mappings []idtools.IDMap) error { func tryMappingTool(uid bool, pid int, hostID int, mappings []idtools.IDMap) error {
var tool = "newuidmap"
if !uid {
tool = "newgidmap"
}
path, err := exec.LookPath(tool) path, err := exec.LookPath(tool)
if err != nil { if err != nil {
return errors.Wrapf(err, "cannot find %s", tool) return errors.Wrapf(err, "cannot find %s", tool)
@ -110,6 +114,15 @@ func tryMappingTool(tool string, pid int, hostID int, mappings []idtools.IDMap)
args := []string{path, fmt.Sprintf("%d", pid)} args := []string{path, fmt.Sprintf("%d", pid)}
args = appendTriplet(args, 0, hostID, 1) args = appendTriplet(args, 0, hostID, 1)
for _, i := range mappings { for _, i := range mappings {
if hostID >= i.HostID && hostID < i.HostID+i.Size {
what := "UID"
where := "/etc/subuid"
if !uid {
what = "GID"
where = "/etc/subgid"
}
return errors.Errorf("invalid configuration: the specified mapping %d:%d in %q includes the user %s", i.HostID, i.Size, where, what)
}
args = appendTriplet(args, i.ContainerID+1, i.HostID, i.Size) args = appendTriplet(args, i.ContainerID+1, i.HostID, i.Size)
} }
cmd := exec.Cmd{ cmd := exec.Cmd{
@ -175,7 +188,7 @@ func GetConfiguredMappings() ([]idtools.IDMap, []idtools.IDMap, error) {
return uids, gids, nil return uids, gids, nil
} }
func becomeRootInUserNS(pausePid, fileToRead string, fileOutput *os.File) (bool, int, error) { func becomeRootInUserNS(pausePid, fileToRead string, fileOutput *os.File) (_ bool, _ int, retErr error) {
if os.Geteuid() == 0 || os.Getenv("_CONTAINERS_USERNS_CONFIGURED") != "" { if os.Geteuid() == 0 || os.Getenv("_CONTAINERS_USERNS_CONFIGURED") != "" {
if os.Getenv("_CONTAINERS_USERNS_CONFIGURED") == "init" { if os.Getenv("_CONTAINERS_USERNS_CONFIGURED") == "init" {
return false, 0, runInUser() return false, 0, runInUser()
@ -205,7 +218,11 @@ func becomeRootInUserNS(pausePid, fileToRead string, fileOutput *os.File) (bool,
defer errorhandling.CloseQuiet(r) defer errorhandling.CloseQuiet(r)
defer errorhandling.CloseQuiet(w) defer errorhandling.CloseQuiet(w)
defer func() { defer func() {
if _, err := w.Write([]byte("0")); err != nil { toWrite := []byte("0")
if retErr != nil {
toWrite = []byte("1")
}
if _, err := w.Write(toWrite); err != nil {
logrus.Errorf("failed to write byte 0: %q", err) logrus.Errorf("failed to write byte 0: %q", err)
} }
}() }()
@ -223,7 +240,11 @@ func becomeRootInUserNS(pausePid, fileToRead string, fileOutput *os.File) (bool,
uidsMapped := false uidsMapped := false
if uids != nil { if uids != nil {
err := tryMappingTool("newuidmap", pid, os.Geteuid(), uids) err := tryMappingTool(true, pid, os.Geteuid(), uids)
// If some mappings were specified, do not ignore the error
if err != nil && len(uids) > 0 {
return false, -1, err
}
uidsMapped = err == nil uidsMapped = err == nil
} }
if !uidsMapped { if !uidsMapped {
@ -245,7 +266,11 @@ func becomeRootInUserNS(pausePid, fileToRead string, fileOutput *os.File) (bool,
gidsMapped := false gidsMapped := false
if gids != nil { if gids != nil {
err := tryMappingTool("newgidmap", pid, os.Getegid(), gids) err := tryMappingTool(false, pid, os.Getegid(), gids)
// If some mappings were specified, do not ignore the error
if err != nil && len(gids) > 0 {
return false, -1, err
}
gidsMapped = err == nil gidsMapped = err == nil
} }
if !gidsMapped { if !gidsMapped {