From 2312fd17cc225a1bc52d469f21a4479b96f87d8f Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Sat, 28 Jan 2023 15:11:29 +0100 Subject: [PATCH 1/2] mkdir-label: Add mkdir_parents_safe_label() --- src/shared/mkdir-label.c | 4 ++++ src/shared/mkdir-label.h | 3 +++ 2 files changed, 7 insertions(+) diff --git a/src/shared/mkdir-label.c b/src/shared/mkdir-label.c index 53081d5e17..e3afc2b666 100644 --- a/src/shared/mkdir-label.c +++ b/src/shared/mkdir-label.c @@ -33,6 +33,10 @@ int mkdirat_parents_label(int dir_fd, const char *path, mode_t mode) { return mkdirat_parents_internal(dir_fd, path, mode, UID_INVALID, UID_INVALID, 0, mkdirat_label); } +int mkdir_parents_safe_label(const char *prefix, const char *path, mode_t mode, uid_t uid, gid_t gid, MkdirFlags flags) { + return mkdir_parents_internal(prefix, path, mode, uid, gid, flags, mkdirat_label); +} + int mkdir_p_label(const char *path, mode_t mode) { return mkdir_p_internal(NULL, path, mode, UID_INVALID, UID_INVALID, 0, mkdirat_label); } diff --git a/src/shared/mkdir-label.h b/src/shared/mkdir-label.h index dcbe5bd546..a9a8ce3a59 100644 --- a/src/shared/mkdir-label.h +++ b/src/shared/mkdir-label.h @@ -20,4 +20,7 @@ int mkdirat_parents_label(int dir_fd, const char *path, mode_t mod); static inline int mkdir_parents_label(const char *path, mode_t mod) { return mkdirat_parents_label(AT_FDCWD, path, mod); } + +int mkdir_parents_safe_label(const char *prefix, const char *path, mode_t mode, uid_t uid, gid_t gid, MkdirFlags flags); + int mkdir_p_label(const char *path, mode_t mode); From 0a67965fa225b0360a3f5de594d0f22490d3eacc Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Sat, 28 Jan 2023 15:12:08 +0100 Subject: [PATCH 2/2] nspawn: Make sure we create bind mount points as the correct UID/GID When using --private-users, we have to create bind mount points as the user that will become root in the user namespace, so let's take that into account. --- src/nspawn/nspawn-mount.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index 9de20126f4..ee00362b54 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -794,7 +794,7 @@ static int mount_bind(const char *dest, CustomMount *m, uid_t uid_shift, uid_t u m->source, where); } else { /* Path doesn't exist yet? */ - r = mkdir_parents_label(where, 0755); + r = mkdir_parents_safe_label(dest, where, 0755, uid_shift, uid_shift, MKDIR_IGNORE_EXISTING); if (r < 0) return log_error_errno(r, "Failed to make parents of %s: %m", where); @@ -808,6 +808,9 @@ static int mount_bind(const char *dest, CustomMount *m, uid_t uid_shift, uid_t u r = touch(where); if (r < 0) return log_error_errno(r, "Failed to create mount point %s: %m", where); + + if (chown(where, uid_shift, uid_shift) < 0) + return log_error_errno(errno, "Failed to chown %s: %m", where); } r = mount_nofollow_verbose(LOG_ERR, m->source, where, NULL, mount_flags, mount_opts);