93 Commits

Author SHA1 Message Date
0a8dcd7112 rootless: provide workaround for missing renameat2
on RHEL 7.7 renameat2 is not implemented for s390x, provide a
workaround.

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1768519

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-11-06 15:27:46 +01:00
a114e9059a rootless: use SYS_renameat2 instead of __NR_renameat2
use the correct definition for the syscall number.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-11-06 13:41:15 +01:00
64f53b4f02 rootless: do not enable lingering mode
do not automatically enable lingering mode.

Closes: https://github.com/containers/libpod/issues/4224

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-10-17 19:12:10 +02:00
550ff9d49a rootless: drop dependency on docker
use the definition from "golang.org/x/sys/unix".

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-10-16 22:22:52 +02:00
3fff42e0ab show uid_map in podman info
show uid_map gid_map in podman info

Signed-off-by: Qi Wang <qiwan@redhat.com>
2019-10-09 21:27:18 -04:00
2ceb03d05e rootless: automatically recreate the pause.pid file
if the pause process cannot be joined, remove the pause.pid while
keeping a lock on it, and try to recreate it.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-10-09 16:02:21 +02:00
9a61b765d0 rootless: do not close files twice
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-10-09 15:49:12 +02:00
62c0b387f5 Set log-level immediately, before rootless setup
If we don't do this, we print WARN level messages that we should
not be printing by default.

Up one WARN message to ERROR so it still shows up by default.

Fixes: #4115
Fixes: #4012

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
2019-09-26 16:14:57 -04:00
1a24ac7ad6 pkg/util: use rootless function to read additional users
make pkg/rootless.GetConfiguredMappings public so that it can be used
from pkg/util.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-09-03 14:38:08 +02:00
cfe1d27688 rootless: detect user namespace configuration changes
detect if the current user namespace doesn't match the configuration
in the /etc/subuid and /etc/subgid files.

If there is a mismatch, raise a warning and suggest the user to
recreate the user namespace with "system migrate", that also restarts
the containers.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-09-03 13:46:48 +02:00
146719718e Merge pull request #3782 from eriksjolund/fix_realloc_in_rootless_linux.c
Fix incorrect use of realloc()
2019-08-11 19:44:58 +02:00
39ce3626e0 Adjust read count so that a newline can be added afterwards
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
2019-08-11 16:44:26 +02:00
4d3cf9b576 Fix incorrect use of realloc()
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
2019-08-11 15:58:20 +02:00
44126969f1 Fix a couple of errors descovered by coverity
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2019-08-09 15:33:16 -04:00
db826d5d75 golangci-lint round #3
this is the third round of preparing to use the golangci-lint on our
code base.

Signed-off-by: baude <bbaude@redhat.com>
2019-07-21 14:22:39 -05:00
a78c885397 golangci-lint pass number 2
clean up and prepare to migrate to the golangci-linter

Signed-off-by: baude <bbaude@redhat.com>
2019-07-11 09:13:06 -05:00
e053e0e05e first pass of corrections for golangci-lint
Signed-off-by: baude <bbaude@redhat.com>
2019-07-10 15:52:17 -05:00
fec1de6ef4 trivial cleanups from golang
the results of a code cleanup performed by the goland IDE.

Signed-off-by: baude <bbaude@redhat.com>
2019-07-03 15:41:33 -05:00
35ab2184a3 rootless: allow to build without cgo
unfortunately rootless won't work without cgo, as most of the
implementation is in C, but at least allow to build libpod.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-07-02 16:41:02 +02:00
4b176d4f45 rootless: do not join namespace if it has already euid == 0
do not attempt to join the rootless namespace if it is running already
with euid == 0.

Closes: https://github.com/containers/libpod/issues/3463

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-07-01 21:58:33 +02:00
5e42bf0717 Merge pull request #3397 from giuseppe/fix-reboot
rootless: enable linger if /run/user/UID not exists
2019-06-28 16:00:55 +02:00
7ea7754e4a Exclude SIGTERM from blocked signals for pause process.
Currently pause process blocks all signals which may cause its
termination, including SIGTERM. This behavior hangs init(1) during
system shutdown, until pause process gets SIGKILLed after some grace
period. To avoid this hanging, SIGTERM is excluded from list of blocked
signals.

Fixes #3440

Signed-off-by: Danila Kiver <danila.kiver@mail.ru>
2019-06-28 00:18:13 +03:00
7255468e65 rootless: enable linger if /run/user/UID not exists
at least on Fedora 30 it creates the /run/user/UID directory for the
user logged in via ssh.

This needs to be done very early so that every other check when we
create the default configuration file will point to the correct
location.

Closes: https://github.com/containers/libpod/issues/3410

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-06-27 16:34:35 +02:00
4bfbc355de Build cgo files with -Wall -Werror
To avoid unnecessary warnings and errors in the future I'd like to
propose building all cgo related sources with `-Wall -Werror`. This
commit fixes some warnings which came up in `shm_lock.c`, too.

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2019-06-21 10:14:19 +02:00
f446ccf0b0 Merge pull request #3379 from openSUSE/rootless-fix
Fix format specifiers in rootless_linux.c
2019-06-21 00:18:24 -07:00
f65ddc0991 Merge pull request #3380 from openSUSE/asprintf-fix
Handle possible asprintf failure in rootless_linux.c
2019-06-20 12:30:27 -07:00
6e318a01a0 Fix execvp uage in rootless_linux.c
The second argument of `execlp` should be of type `char *`, so we need
to add an additional argument there.

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2019-06-20 15:07:01 +02:00
fa1b0a2d89 Handle possible asprintf failure in rootless_linux.c
If `asprintf` fails we early exit now.

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2019-06-20 14:52:32 +02:00
3cf3ccbd77 Fix format specifiers in rootless_linux.c
Format `%d` expects argument of type `int`, but the argument has a type
of `long int`.

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2019-06-20 12:03:04 +02:00
8d2c7c269d Fix cgo includes for musl
closes #3284

Signed-off-by: Cameron Nemo <cnemo@tutanota.com>
2019-06-08 14:15:03 -07:00
4dca13e704 rootless: skip NS_GET_PARENT on old kernels
on old kernels the ioctl NS_GET_PARENT is not available.

Handle the error code and immediately return the same fd.  It should
be fine now that we use the namespace resolution using the conmon pid,
so the namespace parent resolution is just a safety measure.

Closes: https://github.com/containers/libpod/issues/2968

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-06-06 15:32:45 +02:00
6b0e1a3091 rootless: block signals on re-exec
we are allowed to use only signal safe functions between a fork of a
multithreaded application and the next execve.  Since setenv(3) is not
signal safe, block signals.  We are already doing it for creating a
new namespace.

This is mostly a cleanup since reexec_in_user_namespace_wait is used
only only to join existing namespaces when we have not a pause.pid
file.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-06-03 14:25:10 +02:00
27e47cb6d0 rootless: use TEMP_FAILURE_RETRY macro
avoid checking for EINTR for every syscall that could block.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-31 22:05:25 +02:00
b88dc3a41e rootless: fix return type
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-31 22:05:25 +02:00
10983c363e rootless: make sure the buffer is NUL terminated
after we read from the pause PID file, NUL terminate the buffer to
avoid reading garbage from the stack.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-31 22:05:24 +02:00
153503e391 rootless: make JoinUserAndMountNS private
as it is used only by the rootless package now.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-25 13:48:00 +02:00
30ef6ba125 rootless: enable loginctl linger
otherwise the processes we leave around will be killed once the
session terminates.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-25 13:47:58 +02:00
ee11f3bce9 rootless: new function to join existing conmon processes
move the logic for joining existing namespaces down to the rootless
package.  In main_local we still retrieve the list of conmon pid files
and use it from the rootless package.

In addition, create a temporary user namespace for reading these
files, as the unprivileged user might not have enough privileges for
reading the conmon pid file, for example when running with a different
uidmap and root in the container is different than the rootless user.

Closes: https://github.com/containers/libpod/issues/3187

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-25 13:47:57 +02:00
ce26aa701f rootless: block signals for pause
block signals for the pause process, so it can't be killed by
mistake.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-25 13:46:32 +02:00
6df320c391 rootless: store also the original GID in the host
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-23 22:41:48 +02:00
562357ebb2 rootless: join namespace immediately when possible
add a shortcut for joining immediately the namespace so we don't need
to re-exec Podman.

With the pause process simplificaton, we can now attempt to join the
namespaces as soon as Podman starts (and before the Go runtime kicks
in), so that we don't need to re-exec and use just one process.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-17 20:48:24 +02:00
791d53a214 rootless: use a pause process
use a pause process to keep the user and mount namespace alive.

The pause process is created immediately on reload, and all successive
Podman processes will refer to it for joining the user&mount
namespace.

This solves all the race conditions we had on joining the correct
namespaces using the conmon processes.

As a fallback if the join fails for any reason (e.g. the pause process
was killed), then we try to join the running containers as we were
doing before.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-05-17 20:48:24 +02:00
0dfb61d806 rootless: not close more FDs than needed
we were previously closing as many FDs as they were open when we first
started Podman in the range (3-MAX-FD).  This would cause issues if
there were empty intervals, as these FDs are later on used by the
Golang runtime.  Store exactly what FDs were first open in a fd_set,
so that we can close exactly the FDs that were open at startup.

Closes: https://github.com/containers/libpod/issues/2964

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-04-18 14:32:46 +02:00
9e79530f8f Revert "rootless: set controlling terminal for podman in the userns"
This reverts commit 531514e8231e7f42efb7e7992d62e516f9577363.

Closes: https://github.com/containers/libpod/issues/2926

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-04-14 07:48:37 +02:00
814066ee3b rootless: do not block SIGTSTP
we were previously proxying all the signals, but doing that for
SIGTSTP prevented the main process to be stopped by the tty.

Closes: https://github.com/containers/libpod/issues/2775

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-04-12 18:20:40 +02:00
531514e823 rootless: set controlling terminal for podman in the userns
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-04-12 18:20:28 +02:00
72382a12a7 rootless: use a single user namespace
simplify the rootless implementation to use a single user namespace
for all the running containers.

This makes the rootless implementation behave more like root Podman,
where each container is created in the host environment.

There are multiple advantages to it: 1) much simpler implementation as
there is only one namespace to join.  2) we can join namespaces owned
by different containers.  3) commands like ps won't be limited to what
container they can access as previously we either had access to the
storage from a new namespace or access to /proc when running from the
host.  4) rootless varlink works.  5) there are only two ways to enter
in a namespace, either by creating a new one if no containers are
running or joining the existing one from any container.

Containers created by older Podman versions must be restarted.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-04-01 15:32:58 +02:00
ed326206f2 rootless: remove SkipStorageSetup()
in the few places where we care about skipping the storage
initialization, we can simply use the process effective UID, instead
of relying on a global boolean flag.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-04-01 13:24:04 +02:00
ce0ca0d459 rootless: change env prefix
from _LIBPOD to _CONTAINERS.  The same change was done in buildah
unshare.

This is necessary for podman to detect we are running in a rootless
environment and work properly from a "buildah unshare" session.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-03-28 17:08:20 +01:00
e6a4bac09e rootless: use Geteuid instead of Getuid
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2019-03-15 10:39:23 +01:00