diff options
author | Giuseppe Scrivano <gscrivan@redhat.com> | 2018-08-31 09:31:34 +0200 |
---|---|---|
committer | Atomic Bot <atomic-devel@projectatomic.io> | 2018-09-04 14:36:57 +0000 |
commit | 807f6f8d8f98422cfcfe7e474e26a985d951af4d (patch) | |
tree | 6010ce20c6ce8f247cbb8b3e6f29c294521c82ad | |
parent | bdee681409f595443d4f3cb4f08b76d24139d6a8 (diff) | |
download | podman-807f6f8d8f98422cfcfe7e474e26a985d951af4d.tar.gz podman-807f6f8d8f98422cfcfe7e474e26a985d951af4d.tar.bz2 podman-807f6f8d8f98422cfcfe7e474e26a985d951af4d.zip |
rootless: check uid with Geteuid() instead of Getuid()
change the tests to use chroot to set a numeric UID/GID.
Go syscall.Credential doesn't change the effective UID/GID of the
process.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Closes: #1372
Approved by: mheon
-rw-r--r-- | cmd/podman/create.go | 4 | ||||
-rw-r--r-- | cmd/podman/pause.go | 2 | ||||
-rw-r--r-- | cmd/podman/run.go | 2 | ||||
-rw-r--r-- | cmd/podman/stats.go | 2 | ||||
-rw-r--r-- | cmd/podman/unpause.go | 2 | ||||
-rw-r--r-- | libpod/oci_linux.go | 2 | ||||
-rw-r--r-- | libpod/runtime.go | 2 | ||||
-rw-r--r-- | pkg/rootless/rootless_linux.c | 4 | ||||
-rw-r--r-- | pkg/rootless/rootless_linux.go | 8 | ||||
-rw-r--r-- | test/e2e/libpod_suite_test.go | 9 |
10 files changed, 21 insertions, 16 deletions
diff --git a/cmd/podman/create.go b/cmd/podman/create.go index 04f3cd9e6..20d976c0b 100644 --- a/cmd/podman/create.go +++ b/cmd/podman/create.go @@ -99,7 +99,7 @@ func createCmd(c *cli.Context) error { storageOpts.UIDMap = mappings.UIDMap storageOpts.GIDMap = mappings.GIDMap - if os.Getuid() != 0 { + if os.Geteuid() != 0 { rootless.SetSkipStorageSetup(true) } @@ -778,7 +778,7 @@ func parseCreateOpts(ctx context.Context, c *cli.Context, runtime *libpod.Runtim } func joinOrCreateRootlessUserNamespace(createConfig *cc.CreateConfig, runtime *libpod.Runtime) (bool, int, error) { - if os.Getuid() == 0 { + if os.Geteuid() == 0 { return false, 0, nil } diff --git a/cmd/podman/pause.go b/cmd/podman/pause.go index e6224dcd2..203fa6070 100644 --- a/cmd/podman/pause.go +++ b/cmd/podman/pause.go @@ -26,7 +26,7 @@ var ( ) func pauseCmd(c *cli.Context) error { - if os.Getuid() != 0 { + if os.Geteuid() != 0 { return errors.New("pause is not supported for rootless containers") } diff --git a/cmd/podman/run.go b/cmd/podman/run.go index d8a8a48d5..3445daef5 100644 --- a/cmd/podman/run.go +++ b/cmd/podman/run.go @@ -74,7 +74,7 @@ func runCmd(c *cli.Context) error { storageOpts.UIDMap = mappings.UIDMap storageOpts.GIDMap = mappings.GIDMap - if os.Getuid() != 0 { + if os.Geteuid() != 0 { rootless.SetSkipStorageSetup(true) } diff --git a/cmd/podman/stats.go b/cmd/podman/stats.go index 181f5376c..0e1d2a9c6 100644 --- a/cmd/podman/stats.go +++ b/cmd/podman/stats.go @@ -64,7 +64,7 @@ func statsCmd(c *cli.Context) error { return err } - if os.Getuid() != 0 { + if os.Geteuid() != 0 { return errors.New("stats is not supported for rootless containers") } diff --git a/cmd/podman/unpause.go b/cmd/podman/unpause.go index d4e2605cb..a792aaf6d 100644 --- a/cmd/podman/unpause.go +++ b/cmd/podman/unpause.go @@ -26,7 +26,7 @@ var ( ) func unpauseCmd(c *cli.Context) error { - if os.Getuid() != 0 { + if os.Geteuid() != 0 { return errors.New("unpause is not supported for rootless containers") } diff --git a/libpod/oci_linux.go b/libpod/oci_linux.go index 335a7eec3..210ba57d1 100644 --- a/libpod/oci_linux.go +++ b/libpod/oci_linux.go @@ -20,7 +20,7 @@ import ( ) func (r *OCIRuntime) moveConmonToCgroup(ctr *Container, cgroupParent string, cmd *exec.Cmd) error { - if os.Getuid() == 0 { + if os.Geteuid() == 0 { if r.cgroupManager == SystemdCgroupsManager { unitName := createUnitName("libpod-conmon", ctr.ID()) diff --git a/libpod/runtime.go b/libpod/runtime.go index da5d9fa70..c405eb773 100644 --- a/libpod/runtime.go +++ b/libpod/runtime.go @@ -561,7 +561,7 @@ func makeRuntime(runtime *Runtime) (err error) { // empty state only creates a single file // As such, it's not really a performance concern if os.IsNotExist(err) { - if os.Getuid() != 0 { + if os.Geteuid() != 0 { aliveLock.Unlock() locked = false if err2 := runtime.refreshRootless(); err2 != nil { diff --git a/pkg/rootless/rootless_linux.c b/pkg/rootless/rootless_linux.c index e894328ce..d78d95453 100644 --- a/pkg/rootless/rootless_linux.c +++ b/pkg/rootless/rootless_linux.c @@ -107,6 +107,10 @@ reexec_userns_join (int userns) _exit (EXIT_FAILURE); close (userns); + if (setresgid (0, 0, 0) < 0 || + setresuid (0, 0, 0) < 0) + _exit (EXIT_FAILURE); + execvp (argv[0], argv); _exit (EXIT_FAILURE); diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go index 9a8534922..92020cf1c 100644 --- a/pkg/rootless/rootless_linux.go +++ b/pkg/rootless/rootless_linux.go @@ -34,7 +34,7 @@ func runInUser() error { // IsRootless tells us if we are running in rootless mode func IsRootless() bool { - return os.Getuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" + return os.Geteuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" } var ( @@ -88,7 +88,7 @@ func tryMappingTool(tool string, pid int, hostID int, mappings []idtools.IDMap) // JoinNS re-exec podman in a new userNS and join the user namespace of the specified // PID. func JoinNS(pid uint) (bool, int, error) { - if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" { + if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" { return false, -1, nil } @@ -116,7 +116,7 @@ func JoinNS(pid uint) (bool, int, error) { // If podman was re-executed the caller needs to propagate the error code returned by the child // process. func BecomeRootInUserNS() (bool, int, error) { - if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" { + if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" { if os.Getenv("_LIBPOD_USERNS_CONFIGURED") == "init" { return false, 0, runInUser() } @@ -142,7 +142,7 @@ func BecomeRootInUserNS() (bool, int, error) { var uids, gids []idtools.IDMap username := os.Getenv("USER") if username == "" { - user, err := user.LookupId(fmt.Sprintf("%d", os.Geteuid())) + user, err := user.LookupId(fmt.Sprintf("%d", os.Getuid())) if err != nil && os.Getenv("PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS") == "" { return false, 0, errors.Wrapf(err, "could not find user by UID nor USER env was set") } diff --git a/test/e2e/libpod_suite_test.go b/test/e2e/libpod_suite_test.go index 8c9183450..dcc5fd913 100644 --- a/test/e2e/libpod_suite_test.go +++ b/test/e2e/libpod_suite_test.go @@ -10,7 +10,6 @@ import ( "os/exec" "path/filepath" "strings" - "syscall" "testing" "time" @@ -190,11 +189,13 @@ func (p *PodmanTest) PodmanAsUser(args []string, uid, gid uint32, env []string) } else { fmt.Printf("Running: (env: %v) %s %s\n", env, p.PodmanBinary, strings.Join(podmanOptions, " ")) } - command := exec.Command(p.PodmanBinary, podmanOptions...) + var command *exec.Cmd if uid != 0 || gid != 0 { - command.SysProcAttr = &syscall.SysProcAttr{} - command.SysProcAttr.Credential = &syscall.Credential{Uid: uid, Gid: gid} + nsEnterOpts := append([]string{"--userspec", fmt.Sprintf("%d:%d", uid, gid), "/", p.PodmanBinary}, podmanOptions...) + command = exec.Command("chroot", nsEnterOpts...) + } else { + command = exec.Command(p.PodmanBinary, podmanOptions...) } if env != nil { command.Env = env |