From 807f6f8d8f98422cfcfe7e474e26a985d951af4d Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 31 Aug 2018 09:31:34 +0200 Subject: rootless: check uid with Geteuid() instead of Getuid() change the tests to use chroot to set a numeric UID/GID. Go syscall.Credential doesn't change the effective UID/GID of the process. Signed-off-by: Giuseppe Scrivano Closes: #1372 Approved by: mheon --- pkg/rootless/rootless_linux.c | 4 ++++ pkg/rootless/rootless_linux.go | 8 ++++---- 2 files changed, 8 insertions(+), 4 deletions(-) (limited to 'pkg') diff --git a/pkg/rootless/rootless_linux.c b/pkg/rootless/rootless_linux.c index e894328ce..d78d95453 100644 --- a/pkg/rootless/rootless_linux.c +++ b/pkg/rootless/rootless_linux.c @@ -107,6 +107,10 @@ reexec_userns_join (int userns) _exit (EXIT_FAILURE); close (userns); + if (setresgid (0, 0, 0) < 0 || + setresuid (0, 0, 0) < 0) + _exit (EXIT_FAILURE); + execvp (argv[0], argv); _exit (EXIT_FAILURE); diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go index 9a8534922..92020cf1c 100644 --- a/pkg/rootless/rootless_linux.go +++ b/pkg/rootless/rootless_linux.go @@ -34,7 +34,7 @@ func runInUser() error { // IsRootless tells us if we are running in rootless mode func IsRootless() bool { - return os.Getuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" + return os.Geteuid() != 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" } var ( @@ -88,7 +88,7 @@ func tryMappingTool(tool string, pid int, hostID int, mappings []idtools.IDMap) // JoinNS re-exec podman in a new userNS and join the user namespace of the specified // PID. func JoinNS(pid uint) (bool, int, error) { - if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" { + if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" { return false, -1, nil } @@ -116,7 +116,7 @@ func JoinNS(pid uint) (bool, int, error) { // If podman was re-executed the caller needs to propagate the error code returned by the child // process. func BecomeRootInUserNS() (bool, int, error) { - if os.Getuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" { + if os.Geteuid() == 0 || os.Getenv("_LIBPOD_USERNS_CONFIGURED") != "" { if os.Getenv("_LIBPOD_USERNS_CONFIGURED") == "init" { return false, 0, runInUser() } @@ -142,7 +142,7 @@ func BecomeRootInUserNS() (bool, int, error) { var uids, gids []idtools.IDMap username := os.Getenv("USER") if username == "" { - user, err := user.LookupId(fmt.Sprintf("%d", os.Geteuid())) + user, err := user.LookupId(fmt.Sprintf("%d", os.Getuid())) if err != nil && os.Getenv("PODMAN_ALLOW_SINGLE_ID_MAPPING_IN_USERNS") == "" { return false, 0, errors.Wrapf(err, "could not find user by UID nor USER env was set") } -- cgit v1.2.3-54-g00ecf