SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #4372 from evverx/fix-synced-cgroup-hierarchy-perms

Browse Source
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2016-10-23 23:25:57 -04:00
parent 4e5a239fb8 844da987ef
commit 60f17f75d1
7 changed files with 63 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile.am
-1
View File
@@ -6034,7 +6034,6 @@ EXTRA_DIST += \
test/TEST-12-ISSUE-3171/Makefile \
test/TEST-12-ISSUE-3171/test.sh \
test/TEST-13-NSPAWN-SMOKE/Makefile \
test/TEST-13-NSPAWN-SMOKE/has-overflow.c \
test/TEST-13-NSPAWN-SMOKE/create-busybox-container \
test/TEST-13-NSPAWN-SMOKE/test.sh \
test/test-functions
src/basic/mount-util.c
+1 -1
View File
@@ -162,7 +162,7 @@ int fd_is_mount_point(int fd, const char *filename, int flags) {
fallback_fdinfo:
r = fd_fdinfo_mnt_id(fd, filename, flags, &mount_id);
if (r == -EOPNOTSUPP)
if (IN_SET(r, -EOPNOTSUPP, -EACCES))
goto fallback_fstat;
if (r < 0)
return r;
src/nspawn/nspawn-mount.c
+54 -1
View File
@@ -300,6 +300,59 @@ int mount_sysfs(const char *dest) {
MS_BIND|MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REMOUNT, NULL);
}
static int mkdir_userns(const char *path, mode_t mode, bool in_userns, uid_t uid_shift) {
int r;
assert(path);
r = mkdir(path, mode);
if (r < 0 && errno != EEXIST)
return -errno;
if (!in_userns) {
r = lchown(path, uid_shift, uid_shift);
if (r < 0)
return -errno;
}
return 0;
}
static int mkdir_userns_p(const char *prefix, const char *path, mode_t mode, bool in_userns, uid_t uid_shift) {
const char *p, *e;
int r;
assert(path);
if (prefix && !path_startswith(path, prefix))
return -ENOTDIR;
/* create every parent directory in the path, except the last component */
p = path + strspn(path, "/");
for (;;) {
char t[strlen(path) + 1];
e = p + strcspn(p, "/");
p = e + strspn(e, "/");
/* Is this the last component? If so, then we're done */
if (*p == 0)
break;
memcpy(t, path, e - path);
t[e-path] = 0;
if (prefix && path_startswith(prefix, t))
continue;
r = mkdir_userns(t, mode, in_userns, uid_shift);
if (r < 0)
return r;
}
return mkdir_userns(path, mode, in_userns, uid_shift);
}
int mount_all(const char *dest,
bool use_userns, bool in_userns,
bool use_netns,
@@ -361,7 +414,7 @@ int mount_all(const char *dest,
if (mount_table[k].what && r > 0)
continue;
r = mkdir_p(where, 0755);
r = mkdir_userns_p(dest, where, 0755, in_userns, uid_shift);
if (r < 0 && r != -EEXIST) {
if (mount_table[k].fatal)
return log_error_errno(r, "Failed to create directory %s: %m", where);
src/nspawn/nspawn.c
+4 -4
View File
@@ -2684,6 +2684,10 @@ static int inner_child(
}
}
r = reset_uid_gid();
if (r < 0)
return log_error_errno(r, "Couldn't become new root: %m");
r = mount_all(NULL,
arg_userns_mode != USER_NAMESPACE_NO,
true,
@@ -2726,10 +2730,6 @@ static int inner_child(
return r;
}
r = reset_uid_gid();
if (r < 0)
return log_error_errno(r, "Couldn't become new root: %m");
r = setup_boot_id(NULL);
if (r < 0)
return r;
test/TEST-13-NSPAWN-SMOKE/Makefile
+2 -2
View File
@@ -1,7 +1,7 @@
all: has-overflow
all:
@make -s --no-print-directory -C ../.. all
@basedir=../.. TEST_BASE_DIR=../ ./test.sh --all
setup: has-overflow
setup:
@make --no-print-directory -C ../.. all
@basedir=../.. TEST_BASE_DIR=../ ./test.sh --setup
clean:
test/TEST-13-NSPAWN-SMOKE/has-overflow.c
-143
View File
@@ -1,143 +0,0 @@
#define _GNU_SOURCE
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#include <sched.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/wait.h>
#include <signal.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <limits.h>
#include <errno.h>
#include <grp.h>
#define errExit(msg) do { perror(msg); exit(EXIT_FAILURE); } while (0)
struct child_args {
int pipe_fd[2]; /* Pipe used to synchronize parent and child */
};
static void usage(char *pname) {
fprintf(stderr, "Options can be:\n");
fprintf(stderr, "\t-M uid_map Specify UID map for user namespace\n");
fprintf(stderr, "\t-G gid_map Specify GID map for user namespace\n");
exit(EXIT_FAILURE);
}
static void update_map(char *mapping, char *map_file) {
int fd, j;
size_t map_len;
map_len = strlen(mapping);
fd = open(map_file, O_RDWR);
if (fd == -1) {
fprintf(stderr, "ERROR: open %s: %s\n", map_file, strerror(errno));
exit(EXIT_FAILURE);
}
if (write(fd, mapping, map_len) != map_len) {
fprintf(stderr, "ERROR: write %s: %s\n", map_file, strerror(errno));
exit(EXIT_FAILURE);
}
close(fd);
}
static void proc_setgroups_write(pid_t child_pid, char *str) {
char setgroups_path[PATH_MAX];
int fd;
snprintf(setgroups_path, PATH_MAX, "/proc/%ld/setgroups", (long) child_pid);
fd = open(setgroups_path, O_RDWR);
if (fd == -1) {
if (errno != ENOENT)
fprintf(stderr, "ERROR: open %s: %s\n", setgroups_path, strerror(errno));
return;
}
if (write(fd, str, strlen(str)) == -1)
fprintf(stderr, "ERROR: write %s: %s\n", setgroups_path, strerror(errno));
close(fd);
}
static int child_func(void *arg) {
struct child_args *args = (struct child_args *) arg;
char ch;
close(args->pipe_fd[1]);
if (read(args->pipe_fd[0], &ch, 1) != 0) {
fprintf(stderr, "Failure in child: read from pipe returned != 0\n");
exit(EXIT_FAILURE);
}
mount("tmpfs", "/tmp", "tmpfs", MS_MGC_VAL, "mode=777,uid=0,gid=0");
if (mkdir("/tmp/hey", 0777) < 0)
exit(EXIT_FAILURE);
exit(EXIT_SUCCESS);
}
#define STACK_SIZE (1024 * 1024)
static char child_stack[STACK_SIZE];
int main(int argc, char *argv[]) {
int flags, opt;
pid_t child_pid;
struct child_args args;
char *uid_map, *gid_map;
const int MAP_BUF_SIZE = 100;
char map_buf[MAP_BUF_SIZE];
char map_path[PATH_MAX];
int status;
flags = 0;
gid_map = NULL;
uid_map = NULL;
while ((opt = getopt(argc, argv, "+M:G:")) != -1) {
switch (opt) {
case 'M':
uid_map = optarg;
break;
case 'G':
gid_map = optarg;
break;
default:
usage(argv[0]);
}
}
if (!uid_map || !gid_map)
usage(argv[0]);
flags |= CLONE_NEWNS;
flags |= CLONE_NEWUSER;
if (pipe(args.pipe_fd) == -1)
errExit("pipe");
child_pid = clone(child_func, child_stack + STACK_SIZE, flags | SIGCHLD, &args);
if (child_pid == -1)
errExit("clone");
snprintf(map_path, PATH_MAX, "/proc/%ld/uid_map", (long) child_pid);
update_map(uid_map, map_path);
proc_setgroups_write(child_pid, "allow");
snprintf(map_path, PATH_MAX, "/proc/%ld/gid_map", (long) child_pid);
update_map(gid_map, map_path);
close(args.pipe_fd[1]);
if (waitpid(child_pid, &status, 0) == -1)
errExit("waitpid");
exit(WIFEXITED(status) && WEXITSTATUS(status) == EXIT_SUCCESS ? EXIT_FAILURE : EXIT_SUCCESS);
}
test/TEST-13-NSPAWN-SMOKE/test.sh
+2 -17
View File
@@ -40,7 +40,6 @@ test_setup() {
setup_basic_environment
dracut_install busybox chmod rmdir
dracut_install ./has-overflow
cp create-busybox-container $initdir/
@@ -93,22 +92,8 @@ function run {
/create-busybox-container "$_root"
UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" -b
UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" --private-network -b
if ! UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" -U -b; then
if [[ "$1" = "no" && "$2" = "yes" ]] && /has-overflow -M '0 1073283072 65536' -G '0 1073283072 65536'; then
printf "Failure expected, ignoring (see https://github.com/systemd/systemd/issues/4352)\n" >&2
else
return 1
fi
fi
if ! UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" --private-network -U -b; then
if [[ "$1" = "no" && "$2" = "yes" ]] && /has-overflow -M '0 1073283072 65536' -G '0 1073283072 65536'; then
printf "Failure expected, ignoring (see https://github.com/systemd/systemd/issues/4352)\n" >&2
else
return 1
fi
fi
UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" -U -b
UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" --private-network -U -b
return 0
}