Merge pull request #22921 from poettering/uid-range-tweaks

userns uid range tweaks: taint systemd if assigned userns uid range too short, and show userns uid range in userdbctl output

src/shared/uid-range.c

@@ -5,8 +5,13 @@
 #include <string.h>
 
 #include "alloc-util.h"
+#include "errno-util.h"
+#include "fd-util.h"
+#include "format-util.h"
 #include "macro.h"
+#include "path-util.h"
 #include "sort-util.h"
+#include "stat-util.h"
 #include "uid-range.h"
 #include "user-util.h"
 
@@ -17,12 +22,12 @@ static bool uid_range_intersect(UidRange *range, uid_t start, uid_t nr) {
                 range->start + range->nr >= start;
 }
 
-static void uid_range_coalesce(UidRange **p, unsigned *n) {
+static void uid_range_coalesce(UidRange **p, size_t *n) {
         assert(p);
         assert(n);
 
-        for (unsigned i = 0; i < *n; i++) {
-                for (unsigned j = i + 1; j < *n; j++) {
+        for (size_t i = 0; i < *n; i++) {
+                for (size_t j = i + 1; j < *n; j++) {
                         UidRange *x = (*p)+i, *y = (*p)+j;
 
                         if (uid_range_intersect(x, y->start, y->nr)) {
@@ -54,7 +59,7 @@ static int uid_range_compare(const UidRange *a, const UidRange *b) {
         return CMP(a->nr, b->nr);
 }
 
-int uid_range_add(UidRange **p, unsigned *n, uid_t start, uid_t nr) {
+int uid_range_add(UidRange **p, size_t *n, uid_t start, uid_t nr) {
         bool found = false;
         UidRange *x;
 
@@ -64,7 +69,10 @@ int uid_range_add(UidRange **p, unsigned *n, uid_t start, uid_t nr) {
         if (nr <= 0)
                 return 0;
 
-        for (unsigned i = 0; i < *n; i++) {
+        if (start > UINT32_MAX - nr) /* overflow check */
+                return -ERANGE;
+
+        for (size_t i = 0; i < *n; i++) {
                 x = (*p) + i;
                 if (uid_range_intersect(x, start, nr)) {
                         found = true;
@@ -100,7 +108,7 @@ int uid_range_add(UidRange **p, unsigned *n, uid_t start, uid_t nr) {
         return *n;
 }
 
-int uid_range_add_str(UidRange **p, unsigned *n, const char *s) {
+int uid_range_add_str(UidRange **p, size_t *n, const char *s) {
         uid_t start, nr;
         const char *t;
         int r;
@@ -138,15 +146,18 @@ int uid_range_add_str(UidRange **p, unsigned *n, const char *s) {
         return uid_range_add(p, n, start, nr);
 }
 
-int uid_range_next_lower(const UidRange *p, unsigned n, uid_t *uid) {
+int uid_range_next_lower(const UidRange *p, size_t n, uid_t *uid) {
         uid_t closest = UID_INVALID, candidate;
 
         assert(p);
         assert(uid);
 
+        if (*uid == 0)
+                return -EBUSY;
+
         candidate = *uid - 1;
 
-        for (unsigned i = 0; i < n; i++) {
+        for (size_t i = 0; i < n; i++) {
                 uid_t begin, end;
 
                 begin = p[i].start;
@@ -168,13 +179,62 @@ int uid_range_next_lower(const UidRange *p, unsigned n, uid_t *uid) {
         return 1;
 }
 
-bool uid_range_contains(const UidRange *p, unsigned n, uid_t uid) {
-        assert(p);
-        assert(uid);
+bool uid_range_covers(const UidRange *p, size_t n, uid_t start, uid_t nr) {
+        assert(p || n == 0);
 
-        for (unsigned i = 0; i < n; i++)
-                if (uid >= p[i].start && uid < p[i].start + p[i].nr)
+        if (nr == 0) /* empty range? always covered... */
+                return true;
+
+        if (start > UINT32_MAX - nr) /* range overflows? definitely not covered... */
+                return false;
+
+        for (size_t i = 0; i < n; i++)
+                if (start >= p[i].start && start + nr <= p[i].start + p[i].nr)
                         return true;
 
         return false;
 }
+
+int uid_range_load_userns(UidRange **p, size_t *n, const char *path) {
+        _cleanup_fclose_ FILE *f = NULL;
+        int r;
+
+        /* If 'path' is NULL loads the UID range of the userns namespace we run. Otherwise load the data from
+         * the specified file (which can be either uid_map or gid_map, in case caller needs to deal with GID
+         * maps).
+         *
+         * To simplify things this will modify the passed array in case of later failure. */
+
+        if (!path)
+                path = "/proc/self/uid_map";
+
+        f = fopen(path, "re");
+        if (!f) {
+                r = -errno;
+
+                if (r == -ENOENT && path_startswith(path, "/proc/") && proc_mounted() > 0)
+                        return -EOPNOTSUPP;
+
+                return r;
+        }
+
+        for (;;) {
+                uid_t uid_base, uid_shift, uid_range;
+                int k;
+
+                errno = 0;
+                k = fscanf(f, UID_FMT " " UID_FMT " " UID_FMT "\n", &uid_base, &uid_shift, &uid_range);
+                if (k == EOF) {
+                        if (ferror(f))
+                                return errno_or_else(EIO);
+
+                        return 0;
+                }
+                if (k != 3)
+                        return -EBADMSG;
+
+                r = uid_range_add(p, n, uid_base, uid_range);
+                if (r < 0)
+                        return r;
+        }
+}

src/shared/uid-range.h

@@ -8,8 +8,14 @@ typedef struct UidRange {
         uid_t start, nr;
 } UidRange;
 
-int uid_range_add(UidRange **p, unsigned *n, uid_t start, uid_t nr);
-int uid_range_add_str(UidRange **p, unsigned *n, const char *s);
+int uid_range_add(UidRange **p, size_t *n, uid_t start, uid_t nr);
+int uid_range_add_str(UidRange **p, size_t *n, const char *s);
 
-int uid_range_next_lower(const UidRange *p, unsigned n, uid_t *uid);
-bool uid_range_contains(const UidRange *p, unsigned n, uid_t uid);
+int uid_range_next_lower(const UidRange *p, size_t n, uid_t *uid);
+bool uid_range_covers(const UidRange *p, size_t n, uid_t start, uid_t nr);
+
+static inline bool uid_range_contains(const UidRange *p, size_t n, uid_t uid) {
+        return uid_range_covers(p, n, uid, 1);
+}
+
+int uid_range_load_userns(UidRange **p, size_t *n, const char *path);