github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Request 'allow' setgroups when spawning new userns

Browse Source 
Signed-off-by: Mike Baynton <mike@mbaynton.com>
This commit is contained in:
Mike Baynton 2024-10-17 15:36:15 -05:00
parent ce265ff955
commit 347423a114
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/sys/unshare_linux.go
View File

@ -49,10 +49,11 @@ func UnshareAfterEnterUserns(uidMap, gidMap string, unshareFlags uintptr, f func
proc, err := os.StartProcess("/proc/self/exe", []string{"UnshareAfterEnterUserns"}, &os.ProcAttr{ proc, err := os.StartProcess("/proc/self/exe", []string{"UnshareAfterEnterUserns"}, &os.ProcAttr{
Sys: &syscall.SysProcAttr{ Sys: &syscall.SysProcAttr{
// clone new user namespace first and then unshare // clone new user namespace first and then unshare
Cloneflags: unix.CLONE_NEWUSER, Cloneflags: unix.CLONE_NEWUSER,
Unshareflags: unshareFlags, Unshareflags: unshareFlags,
UidMappings: uidMaps, UidMappings: uidMaps,
GidMappings: gidMaps, GidMappings: gidMaps,
GidMappingsEnableSetgroups: true,
// NOTE: It's reexec but it's not heavy because subprocess // NOTE: It's reexec but it's not heavy because subprocess
// be in PTRACE_TRACEME mode before performing execve. // be in PTRACE_TRACEME mode before performing execve.
Ptrace: true, Ptrace: true,

4
pkg/sys/unshare_linux_test.go
View File

@ -85,6 +85,10 @@ func testUnshareAfterEnterUsernsShouldWork(t *testing.T) {
data, err = os.ReadFile(fmt.Sprintf("/proc/%d/gid_map", pid)) data, err = os.ReadFile(fmt.Sprintf("/proc/%d/gid_map", pid))
require.NoError(t, err) require.NoError(t, err)
require.Equal(t, " 0 1000 10\n", string(data)) require.Equal(t, " 0 1000 10\n", string(data))
data, err = os.ReadFile(fmt.Sprintf("/proc/%d/setgroups", pid))
require.NoError(t, err)
require.Equal(t, "allow\n", string(data))
return nil return nil
}) })
require.NoError(t, uerr) require.NoError(t, uerr)