summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2018-08-31 09:31:34 +0200
committerAtomic Bot <atomic-devel@projectatomic.io>2018-09-04 14:36:57 +0000
commit807f6f8d8f98422cfcfe7e474e26a985d951af4d (patch)
tree6010ce20c6ce8f247cbb8b3e6f29c294521c82ad /pkg
parentbdee681409f595443d4f3cb4f08b76d24139d6a8 (diff)
downloadpodman-807f6f8d8f98422cfcfe7e474e26a985d951af4d.tar.gz
podman-807f6f8d8f98422cfcfe7e474e26a985d951af4d.tar.bz2
podman-807f6f8d8f98422cfcfe7e474e26a985d951af4d.zip
rootless: check uid with Geteuid() instead of Getuid()
change the tests to use chroot to set a numeric UID/GID. Go syscall.Credential doesn't change the effective UID/GID of the process. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1372 Approved by: mheon
Diffstat (limited to 'pkg')
-rw-r--r--pkg/rootless/rootless_linux.c4
-rw-r--r--pkg/rootless/rootless_linux.go8
2 files changed, 8 insertions, 4 deletions
diff --git a/pkg/rootless/rootless_linux.c b/pkg/rootless/rootless_linux.c
index e894328ce..d78d95453 100644
--- a/pkg/rootless/rootless_linux.c
+++ b/pkg/rootless/rootless_linux.c
@@ -107,6 +107,10 @@ reexec_userns_join (int userns)
_exit (EXIT_FAILURE);
close (userns);
+ if (setresgid (0, 0, 0) < 0 ||
+ setresuid (0, 0, 0) < 0)
+ _exit (EXIT_FAILURE);
+
execvp (argv[0], argv);
_exit (EXIT_FAILURE);
diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go
index 9a8534922..92020cf1c 100644
--- a/pkg/rootless/rootless_linux.go
+++ b/pkg/rootless/rootless_linux.go
@@ -34,7 +34,7 @@ func runInUser() error {
// IsRootless tells us if we are running in rootless mode
func IsRootless() bool {
- return os.Getuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != ""
+ return os.Geteuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != ""
}
var (
@@ -88,7 +88,7 @@ func tryMappingTool(tool string, pid int, hostID int, mappings []idtools.IDMap)
// JoinNS re-exec podman in a new userNS and join the user namespace of the specified
// PID.
func JoinNS(pid uint) (bool, int, error) {
- if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
+ if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
return false, -1, nil
}
@@ -116,7 +116,7 @@ func JoinNS(pid uint) (bool, int, error) {
// If podman was re-executed the caller needs to propagate the error code returned by the child
// process.
func BecomeRootInUserNS() (bool, int, error) {
- if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
+ if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" {
if os.Getenv("_LIBPOD_USERNS_CONFIGURED") == "init" {
return false, 0, runInUser()
}
@@ -142,7 +142,7 @@ func BecomeRootInUserNS() (bool, int, error) {
var uids, gids []idtools.IDMap
username := os.Getenv("USER")
if username == "" {
- user, err := user.LookupId(fmt.Sprintf("%d", os.Geteuid()))
+ user, err := user.LookupId(fmt.Sprintf("%d", os.Getuid()))
if err != nil && os.Getenv("PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS") == "" {
return false, 0, errors.Wrapf(err, "could not find user by UID nor USER env was set")
}