--- /dev/null
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "fd-util.h"
+#include "fileio.h"
+#include "format-util.h"
+#include "fs-util.h"
+#include "nspawn-bind-user.h"
+#include "nspawn.h"
+#include "path-util.h"
+#include "user-util.h"
+#include "userdb.h"
+
+#define MAP_UID_START 60514
+#define MAP_UID_END 60577
+
+static int check_etc_passwd_collisions(
+ const char *directory,
+ const char *name,
+ uid_t uid) {
+
+ _cleanup_fclose_ FILE *f = NULL;
+ int r;
+
+ assert(directory);
+ assert(name || uid_is_valid(uid));
+
+ r = chase_symlinks_and_fopen_unlocked("/etc/passwd", directory, CHASE_PREFIX_ROOT, "re", &f, NULL);
+ if (r == -ENOENT)
+ return 0; /* no user database? then no user, hence no collision */
+ if (r < 0)
+ return log_error_errno(r, "Failed to open /etc/passwd of container: %m");
+
+ for (;;) {
+ struct passwd *pw;
+
+ r = fgetpwent_sane(f, &pw);
+ if (r < 0)
+ return log_error_errno(r, "Failed to iterate through /etc/passwd of container: %m");
+ if (r == 0) /* EOF */
+ return 0; /* no collision */
+
+ if (name && streq_ptr(pw->pw_name, name))
+ return 1; /* name collision */
+ if (uid_is_valid(uid) && pw->pw_uid == uid)
+ return 1; /* UID collision */
+ }
+}
+
+static int check_etc_group_collisions(
+ const char *directory,
+ const char *name,
+ gid_t gid) {
+
+ _cleanup_fclose_ FILE *f = NULL;
+ int r;
+
+ assert(directory);
+ assert(name || gid_is_valid(gid));
+
+ r = chase_symlinks_and_fopen_unlocked("/etc/group", directory, CHASE_PREFIX_ROOT, "re", &f, NULL);
+ if (r == -ENOENT)
+ return 0; /* no group database? then no group, hence no collision */
+ if (r < 0)
+ return log_error_errno(r, "Failed to open /etc/group of container: %m");
+
+ for (;;) {
+ struct group *gr;
+
+ r = fgetgrent_sane(f, &gr);
+ if (r < 0)
+ return log_error_errno(r, "Failed to iterate through /etc/group of container: %m");
+ if (r == 0)
+ return 0; /* no collision */
+
+ if (name && streq_ptr(gr->gr_name, name))
+ return 1; /* name collision */
+ if (gid_is_valid(gid) && gr->gr_gid == gid)
+ return 1; /* gid collision */
+ }
+}
+
+static int convert_user(
+ const char *directory,
+ UserRecord *u,
+ GroupRecord *g,
+ uid_t allocate_uid,
+ UserRecord **ret_converted_user,
+ GroupRecord **ret_converted_group) {
+
+ _cleanup_(group_record_unrefp) GroupRecord *converted_group = NULL;
+ _cleanup_(user_record_unrefp) UserRecord *converted_user = NULL;
+ _cleanup_free_ char *h = NULL;
+ JsonVariant *p, *hp = NULL;
+ int r;
+
+ assert(u);
+ assert(g);
+ assert(u->gid == g->gid);
+
+ r = check_etc_passwd_collisions(directory, u->user_name, UID_INVALID);
+ if (r < 0)
+ return r;
+ if (r > 0)
+ return log_error_errno(SYNTHETIC_ERRNO(EBUSY),
+ "Sorry, the user '%s' already exists in the container.", u->user_name);
+
+ r = check_etc_group_collisions(directory, g->group_name, GID_INVALID);
+ if (r < 0)
+ return r;
+ if (r > 0)
+ return log_error_errno(SYNTHETIC_ERRNO(EBUSY),
+ "Sorry, the group '%s' already exists in the container.", g->group_name);
+
+ h = path_join("/run/host/home/", u->user_name);
+ if (!h)
+ return log_oom();
+
+ /* Acquire the source hashed password array as-is, so that it retains the JSON_VARIANT_SENSITIVE flag */
+ p = json_variant_by_key(u->json, "privileged");
+ if (p)
+ hp = json_variant_by_key(p, "hashedPassword");
+
+ r = user_record_build(
+ &converted_user,
+ JSON_BUILD_OBJECT(
+ JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(u->user_name)),
+ JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(allocate_uid)),
+ JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(allocate_uid)),
+ JSON_BUILD_PAIR_CONDITION(u->disposition >= 0, "disposition", JSON_BUILD_STRING(user_disposition_to_string(u->disposition))),
+ JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_STRING(h)),
+ JSON_BUILD_PAIR("service", JSON_BUILD_STRING("io.systemd.NSpawn")),
+ JSON_BUILD_PAIR_CONDITION(!strv_isempty(u->hashed_password), "privileged", JSON_BUILD_OBJECT(
+ JSON_BUILD_PAIR("hashedPassword", JSON_BUILD_VARIANT(hp))))));
+ if (r < 0)
+ return log_error_errno(r, "Failed to build container user record: %m");
+
+ r = group_record_build(
+ &converted_group,
+ JSON_BUILD_OBJECT(
+ JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(g->group_name)),
+ JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(allocate_uid)),
+ JSON_BUILD_PAIR_CONDITION(g->disposition >= 0, "disposition", JSON_BUILD_STRING(user_disposition_to_string(g->disposition))),
+ JSON_BUILD_PAIR("service", JSON_BUILD_STRING("io.systemd.NSpawn"))));
+ if (r < 0)
+ return log_error_errno(r, "Failed to build container group record: %m");
+
+ *ret_converted_user = TAKE_PTR(converted_user);
+ *ret_converted_group = TAKE_PTR(converted_group);
+
+ return 0;
+}
+
+static int find_free_uid(const char *directory, uid_t max_uid, uid_t *current_uid) {
+ int r;
+
+ assert(directory);
+ assert(current_uid);
+
+ for (;; (*current_uid) ++) {
+ if (*current_uid > MAP_UID_END || *current_uid > max_uid)
+ return log_error_errno(
+ SYNTHETIC_ERRNO(EBUSY),
+ "No suitable available UID in range " UID_FMT "…" UID_FMT " in container detected, can't map user.",
+ MAP_UID_START, MAP_UID_END);
+
+ r = check_etc_passwd_collisions(directory, NULL, *current_uid);
+ if (r < 0)
+ return r;
+ if (r > 0) /* already used */
+ continue;
+
+ /* We want to use the UID also as GID, hence check for it in /etc/group too */
+ r = check_etc_group_collisions(directory, NULL, (gid_t) *current_uid);
+ if (r < 0)
+ return r;
+ if (r == 0) /* free! yay! */
+ return 0;
+ }
+}
+
+BindUserContext* bind_user_context_free(BindUserContext *c) {
+ if (!c)
+ return NULL;
+
+ assert(c->n_data == 0 || c->data);
+
+ for (size_t i = 0; i < c->n_data; i++) {
+ user_record_unref(c->data[i].host_user);
+ group_record_unref(c->data[i].host_group);
+ user_record_unref(c->data[i].payload_user);
+ group_record_unref(c->data[i].payload_group);
+ }
+
+ return mfree(c);
+}
+
+int bind_user_prepare(
+ const char *directory,
+ char **bind_user,
+ uid_t uid_shift,
+ uid_t uid_range,
+ CustomMount **custom_mounts,
+ size_t *n_custom_mounts,
+ BindUserContext **ret) {
+
+ _cleanup_(bind_user_context_freep) BindUserContext *c = NULL;
+ uid_t current_uid = MAP_UID_START;
+ size_t n_allocated = 0;
+ char **n;
+ int r;
+
+ assert(custom_mounts);
+ assert(n_custom_mounts);
+ assert(ret);
+
+ /* This resolves the users specified in 'bind_user', generates a minimalized JSON user + group record
+ * for it to stick in the container, allocates a UID/GID for it, and updates the custom mount table,
+ * to include an appropriate bind mount mapping.
+ *
+ * This extends the passed custom_mounts/n_custom_mounts with the home directories, and allocates a
+ * new BindUserContext for the user records */
+
+ if (strv_isempty(bind_user)) {
+ *ret = NULL;
+ return 0;
+ }
+
+ c = new0(BindUserContext, 1);
+ if (!c)
+ return log_oom();
+
+ STRV_FOREACH(n, bind_user) {
+ _cleanup_(user_record_unrefp) UserRecord *u = NULL, *cu = NULL;
+ _cleanup_(group_record_unrefp) GroupRecord *g = NULL, *cg = NULL;
+ _cleanup_free_ char *sm = NULL, *sd = NULL;
+ CustomMount *cm;
+
+ r = userdb_by_name(*n, USERDB_DONT_SYNTHESIZE, &u);
+ if (r < 0)
+ return log_error_errno(r, "Failed to resolve user '%s': %m", *n);
+
+ /* For now, let's refuse mapping the root/nobody users explicitly. The records we generate
+ * are strictly additive, nss-systemd is typically placed last in /etc/nsswitch.conf. Thus
+ * even if we wanted, we couldn't override the root or nobody user records. Note we also
+ * check for name conflicts in /etc/passwd + /etc/group later on, which would usually filter
+ * out root/nobody too, hence these checks might appear redundant — but they actually are
+ * not, as we want to support environments where /etc/passwd and /etc/group are non-existent,
+ * and the user/group databases fully synthesized at runtime. Moreover, the name of the
+ * user/group name of the "nobody" account differs between distros, hence a check by numeric
+ * UID is safer. */
+ if (u->uid == 0 || streq(u->user_name, "root"))
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Mapping 'root' user not supported, sorry.");
+ if (u->uid == UID_NOBODY || STR_IN_SET(u->user_name, NOBODY_USER_NAME, "nobody"))
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Mapping 'nobody' user not supported, sorry.");
+
+ if (u->uid >= uid_shift && u->uid < uid_shift + uid_range)
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "UID of user '%s' to map is already in container UID range, refusing.", u->user_name);
+
+ r = groupdb_by_gid(u->gid, USERDB_DONT_SYNTHESIZE, &g);
+ if (r < 0)
+ return log_error_errno(r, "Failed to resolve group of user '%s': %m", u->user_name);
+
+ if (g->gid >= uid_shift && g->gid < uid_shift + uid_range)
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "GID of group '%s' to map is already in container GID range, refusing.", g->group_name);
+
+ /* We want to synthesize exactly one user + group from the host into the container. This only
+ * makes sense if the user on the host has its own private group. We can't reasonably check
+ * this, so we just check of the name of user and group match.
+ *
+ * One of these days we might want to support users in a shared/common group too, but it's
+ * not clear to me how this would have to be mapped, precisely given that the common group
+ * probably already exists in the container. */
+ if (!streq(u->user_name, g->group_name))
+ return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
+ "Sorry, mapping users without private groups is currently not supported.");
+
+ r = find_free_uid(directory, uid_range, ¤t_uid);
+ if (r < 0)
+ return r;
+
+ r = convert_user(directory, u, g, current_uid, &cu, &cg);
+ if (r < 0)
+ return r;
+
+ if (!GREEDY_REALLOC(c->data, n_allocated, c->n_data + 1))
+ return log_oom();
+
+ sm = strdup(u->home_directory);
+ if (!sm)
+ return log_oom();
+
+ sd = strdup(cu->home_directory);
+ if (!sd)
+ return log_oom();
+
+ cm = reallocarray(*custom_mounts, sizeof(CustomMount), *n_custom_mounts + 1);
+ if (!cm)
+ return log_oom();
+
+ *custom_mounts = cm;
+
+ (*custom_mounts)[(*n_custom_mounts)++] = (CustomMount) {
+ .type = CUSTOM_MOUNT_BIND,
+ .source = TAKE_PTR(sm),
+ .destination = TAKE_PTR(sd),
+ };
+
+ c->data[c->n_data++] = (BindUserData) {
+ .host_user = TAKE_PTR(u),
+ .host_group = TAKE_PTR(g),
+ .payload_user = TAKE_PTR(cu),
+ .payload_group = TAKE_PTR(cg),
+ };
+
+ current_uid++;
+ }
+
+ *ret = TAKE_PTR(c);
+ return 1;
+}
+
+static int write_and_symlink(
+ const char *root,
+ JsonVariant *v,
+ const char *name,
+ uid_t uid,
+ const char *suffix,
+ WriteStringFileFlags extra_flags) {
+
+ _cleanup_free_ char *j = NULL, *f = NULL, *p = NULL, *q = NULL;
+ int r;
+
+ assert(root);
+ assert(v);
+ assert(name);
+ assert(uid_is_valid(uid));
+ assert(suffix);
+
+ r = json_variant_format(v, JSON_FORMAT_NEWLINE, &j);
+ if (r < 0)
+ return log_error_errno(r, "Failed to format user record JSON: %m");
+
+ f = strjoin(name, suffix);
+ if (!f)
+ return log_oom();
+
+ p = path_join(root, "/run/host/userdb/", f);
+ if (!p)
+ return log_oom();
+
+ if (asprintf(&q, "%s/run/host/userdb/" UID_FMT "%s", root, uid, suffix) < 0)
+ return log_oom();
+
+ if (symlink(f, q) < 0)
+ return log_error_errno(errno, "Failed to create symlink '%s': %m", q);
+
+ r = userns_lchown(q, 0, 0);
+ if (r < 0)
+ return log_error_errno(r, "Failed to adjust access mode of '%s': %m", q);
+
+ r = write_string_file(p, j, WRITE_STRING_FILE_CREATE|extra_flags);
+ if (r < 0)
+ return log_error_errno(r, "Failed to write %s: %m", p);
+
+ r = userns_lchown(p, 0, 0);
+ if (r < 0)
+ return log_error_errno(r, "Failed to adjust access mode of '%s': %m", p);
+
+ return 0;
+}
+
+int bind_user_setup(
+ const BindUserContext *c,
+ const char *root) {
+
+ static const UserRecordLoadFlags strip_flags = /* Removes privileged info */
+ USER_RECORD_REQUIRE_REGULAR|
+ USER_RECORD_STRIP_PRIVILEGED|
+ USER_RECORD_ALLOW_PER_MACHINE|
+ USER_RECORD_ALLOW_BINDING|
+ USER_RECORD_ALLOW_SIGNATURE;
+ static const UserRecordLoadFlags shadow_flags = /* Extracts privileged info */
+ USER_RECORD_STRIP_REGULAR|
+ USER_RECORD_ALLOW_PRIVILEGED|
+ USER_RECORD_STRIP_PER_MACHINE|
+ USER_RECORD_STRIP_BINDING|
+ USER_RECORD_STRIP_SIGNATURE|
+ USER_RECORD_EMPTY_OK;
+ int r;
+
+ assert(root);
+
+ if (!c || c->n_data == 0)
+ return 0;
+
+ r = userns_mkdir(root, "/run/host", 0755, 0, 0);
+ if (r < 0)
+ return log_error_errno(r, "Failed to create /run/host: %m");
+
+ r = userns_mkdir(root, "/run/host/home", 0755, 0, 0);
+ if (r < 0)
+ return log_error_errno(r, "Failed to create /run/host/userdb: %m");
+
+ r = userns_mkdir(root, "/run/host/userdb", 0755, 0, 0);
+ if (r < 0)
+ return log_error_errno(r, "Failed to create /run/host/userdb: %m");
+
+ for (size_t i = 0; i < c->n_data; i++) {
+ _cleanup_(group_record_unrefp) GroupRecord *stripped_group = NULL, *shadow_group = NULL;
+ _cleanup_(user_record_unrefp) UserRecord *stripped_user = NULL, *shadow_user = NULL;
+ const BindUserData *d = c->data + i;
+
+ /* First, write shadow (i.e. privileged) data for group record */
+ r = group_record_clone(d->payload_group, shadow_flags, &shadow_group);
+ if (r < 0)
+ return log_error_errno(r, "Failed to extract privileged information from group record: %m");
+
+ if (!json_variant_is_blank_object(shadow_group->json)) {
+ r = write_and_symlink(
+ root,
+ shadow_group->json,
+ d->payload_group->group_name,
+ d->payload_group->gid,
+ ".group-privileged",
+ WRITE_STRING_FILE_MODE_0600);
+ if (r < 0)
+ return r;
+ }
+
+ /* Second, write main part of group record. */
+ r = group_record_clone(d->payload_group, strip_flags, &stripped_group);
+ if (r < 0)
+ return log_error_errno(r, "Failed to strip privileged information from group record: %m");
+
+ r = write_and_symlink(
+ root,
+ stripped_group->json,
+ d->payload_group->group_name,
+ d->payload_group->gid,
+ ".group",
+ 0);
+ if (r < 0)
+ return r;
+
+ /* Third, write out user shadow data. i.e. extract privileged info from user record */
+ r = user_record_clone(d->payload_user, shadow_flags, &shadow_user);
+ if (r < 0)
+ return log_error_errno(r, "Failed to extract privileged information from user record: %m");
+
+ if (!json_variant_is_blank_object(shadow_user->json)) {
+ r = write_and_symlink(
+ root,
+ shadow_user->json,
+ d->payload_user->user_name,
+ d->payload_user->uid,
+ ".user-privileged",
+ WRITE_STRING_FILE_MODE_0600);
+ if (r < 0)
+ return r;
+ }
+
+ /* Finally write out the main part of the user record */
+ r = user_record_clone(d->payload_user, strip_flags, &stripped_user);
+ if (r < 0)
+ return log_error_errno(r, "Failed to strip privileged information from user record: %m");
+
+ r = write_and_symlink(
+ root,
+ stripped_user->json,
+ d->payload_user->user_name,
+ d->payload_user->uid,
+ ".user",
+ 0);
+ if (r < 0)
+ return r;
+ }
+
+ return 1;
+}
#include "mountpoint-util.h"
#include "namespace-util.h"
#include "netlink-util.h"
+#include "nspawn-bind-user.h"
#include "nspawn-cgroup.h"
#include "nspawn-creds.h"
#include "nspawn-def.h"
static ConsoleMode arg_console_mode = _CONSOLE_MODE_INVALID;
static Credential *arg_credentials = NULL;
static size_t arg_n_credentials = 0;
+static char **arg_bind_user = NULL;
STATIC_DESTRUCTOR_REGISTER(arg_directory, freep);
STATIC_DESTRUCTOR_REGISTER(arg_template, freep);
#endif
STATIC_DESTRUCTOR_REGISTER(arg_cpu_set, cpu_set_reset);
STATIC_DESTRUCTOR_REGISTER(arg_sysctl, strv_freep);
+STATIC_DESTRUCTOR_REGISTER(arg_bind_user, strv_freep);
static int handle_arg_console(const char *arg) {
if (streq(arg, "help")) {
" Create an overlay mount from the host to \n"
" the container\n"
" --overlay-ro=PATH[:PATH...]:PATH\n"
- " Similar, but creates a read-only overlay mount\n\n"
+ " Similar, but creates a read-only overlay mount\n"
+ " --bind-user=NAME Bind user from host to container\n\n"
"%3$sInput/Output:%4$s\n"
" --console=MODE Select how stdin/stdout/stderr and /dev/console are\n"
" set up for the container.\n"
ARG_NO_PAGER,
ARG_SET_CREDENTIAL,
ARG_LOAD_CREDENTIAL,
+ ARG_BIND_USER,
};
static const struct option options[] = {
{ "no-pager", no_argument, NULL, ARG_NO_PAGER },
{ "set-credential", required_argument, NULL, ARG_SET_CREDENTIAL },
{ "load-credential", required_argument, NULL, ARG_LOAD_CREDENTIAL },
+ { "bind-user", required_argument, NULL, ARG_BIND_USER },
{}
};
break;
}
+ case ARG_BIND_USER:
+ if (!valid_user_group_name(optarg, 0))
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid user name to bind: %s", optarg);
+
+ if (strv_extend(&arg_bind_user, optarg) < 0)
+ return log_oom();
+
+ arg_settings_mask |= SETTING_BIND_USER;
+ break;
+
case '?':
return -EINVAL;
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "AmbientCapability= setting is not useful for boot mode.");
}
+ if (arg_userns_mode == USER_NAMESPACE_NO && !strv_isempty(arg_bind_user))
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--bind-user= requires --private-users");
+
+ /* Drop duplicate --bind-user= entries */
+ strv_uniq(arg_bind_user);
+
r = custom_mount_check_all();
if (r < 0)
return r;
FDSet *fds,
int netns_fd) {
+ _cleanup_(bind_user_context_freep) BindUserContext *bind_user_context = NULL;
_cleanup_strv_free_ char **os_release_pairs = NULL;
_cleanup_close_ int fd = -1;
bool idmap = false;
if (r < 0)
return r;
+ r = bind_user_prepare(
+ directory,
+ arg_bind_user,
+ arg_uid_shift,
+ arg_uid_range,
+ &arg_custom_mounts, &arg_n_custom_mounts,
+ &bind_user_context);
+ if (r < 0)
+ return r;
+
+ if (arg_userns_mode != USER_NAMESPACE_NO && bind_user_context) {
+ /* Send the user maps we determined to the parent, so that it installs it in our user namespace UID map table */
+
+ for (size_t i = 0; i < bind_user_context->n_data; i++) {
+ uid_t map[] = {
+ bind_user_context->data[i].payload_user->uid,
+ bind_user_context->data[i].host_user->uid,
+ (uid_t) bind_user_context->data[i].payload_group->gid,
+ (uid_t) bind_user_context->data[i].host_group->gid,
+ };
+
+ l = send(uid_shift_socket, map, sizeof(map), MSG_NOSIGNAL);
+ if (l < 0)
+ return log_error_errno(errno, "Failed to send user UID map: %m");
+ if (l != sizeof(map))
+ return log_error_errno(SYNTHETIC_ERRNO(EIO),
+ "Short write while sending user UID map.");
+ }
+ }
+
r = mount_custom(
directory,
arg_custom_mounts,
if (r < 0)
return r;
+ r = bind_user_setup(bind_user_context, directory);
+ if (r < 0)
+ return r;
+
r = mount_custom(
directory,
arg_custom_mounts,
}
}
-static int setup_uid_map(pid_t pid) {
- char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1], line[DECIMAL_STR_MAX(uid_t)*3+3+1];
+static int add_one_uid_map(
+ char **p,
+ uid_t container_uid,
+ uid_t host_uid,
+ uid_t range) {
+
+ return strextendf(p,
+ UID_FMT " " UID_FMT " " UID_FMT "\n",
+ container_uid, host_uid, range);
+}
+
+static int make_uid_map_string(
+ const uid_t bind_user_uid[],
+ size_t n_bind_user_uid,
+ size_t offset,
+ char **ret) {
+
+ _cleanup_free_ char *s = NULL;
+ uid_t previous_uid = 0;
+ int r;
+
+ assert(n_bind_user_uid == 0 || bind_user_uid);
+ assert(offset == 0 || offset == 2); /* used to switch between UID and GID map */
+ assert(ret);
+
+ /* The bind_user_uid[] array is a series of 4 uid_t values, for each --bind-user= entry one
+ * quadruplet, consisting of host and container UID + GID. */
+
+ for (size_t i = 0; i < n_bind_user_uid; i++) {
+ uid_t payload_uid = bind_user_uid[i*2+offset],
+ host_uid = bind_user_uid[i*2+offset+1];
+
+ assert(previous_uid <= payload_uid);
+ assert(payload_uid < arg_uid_range);
+
+ /* Add a range to close the gap to previous entry */
+ if (payload_uid > previous_uid) {
+ r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, payload_uid - previous_uid);
+ if (r < 0)
+ return r;
+ }
+
+ /* Map this specific user */
+ r = add_one_uid_map(&s, payload_uid, host_uid, 1);
+ if (r < 0)
+ return r;
+
+ previous_uid = payload_uid + 1;
+ }
+
+ /* And add a range to close the gap to finish the range */
+ if (arg_uid_range > previous_uid) {
+ r = add_one_uid_map(&s, previous_uid, arg_uid_shift + previous_uid, arg_uid_range - previous_uid);
+ if (r < 0)
+ return r;
+ }
+
+ assert(s);
+
+ *ret = TAKE_PTR(s);
+ return 0;
+}
+
+static int setup_uid_map(
+ pid_t pid,
+ const uid_t bind_user_uid[],
+ size_t n_bind_user_uid) {
+
+ char uid_map[STRLEN("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1];
+ _cleanup_free_ char *s = NULL;
int r;
assert(pid > 1);
+ /* Build the UID map string */
+ if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 0, &s) < 0) /* offset=0 contains the UID pair */
+ return log_oom();
+
xsprintf(uid_map, "/proc/" PID_FMT "/uid_map", pid);
- xsprintf(line, UID_FMT " " UID_FMT " " UID_FMT "\n", 0, arg_uid_shift, arg_uid_range);
- r = write_string_file(uid_map, line, WRITE_STRING_FILE_DISABLE_BUFFER);
+ r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
return log_error_errno(r, "Failed to write UID map: %m");
- /* We always assign the same UID and GID ranges */
+ /* And now build the GID map string */
+ s = mfree(s);
+ if (make_uid_map_string(bind_user_uid, n_bind_user_uid, 2, &s) < 0) /* offset=2 contains the GID pair */
+ return log_oom();
+
xsprintf(uid_map, "/proc/" PID_FMT "/gid_map", pid);
- r = write_string_file(uid_map, line, WRITE_STRING_FILE_DISABLE_BUFFER);
+ r = write_string_file(uid_map, s, WRITE_STRING_FILE_DISABLE_BUFFER);
if (r < 0)
return log_error_errno(r, "Failed to write GID map: %m");
}
}
+ if ((arg_settings_mask & SETTING_BIND_USER) == 0)
+ strv_free_and_replace(arg_bind_user, settings->bind_user);
+
if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0)
arg_notify_ready = settings->notify_ready;
_cleanup_(pty_forward_freep) PTYForward *forward = NULL;
_cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
_cleanup_(sd_bus_flush_close_unrefp) sd_bus *bus = NULL;
+ _cleanup_free_ uid_t *bind_user_uid = NULL;
+ size_t n_bind_user_uid = 0;
ContainerStatus container_status = 0;
int ifi = 0, r;
ssize_t l;
if (l != sizeof arg_uid_shift)
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while writing UID shift.");
}
+
+ n_bind_user_uid = strv_length(arg_bind_user);
+ if (n_bind_user_uid > 0) {
+ /* Right after the UID shift, we'll receive the list of UID mappings for the
+ * --bind-user= logic. Always a quadruplet of payload and host UID + GID. */
+
+ bind_user_uid = new(uid_t, n_bind_user_uid*4);
+ if (!bind_user_uid)
+ return log_oom();
+
+ for (size_t i = 0; i < n_bind_user_uid; i++) {
+ l = recv(uid_shift_socket_pair[0], bind_user_uid + i*4, sizeof(uid_t)*4, 0);
+ if (l < 0)
+ return log_error_errno(errno, "Failed to read user UID map pair: %m");
+ if (l != sizeof(uid_t)*4)
+ return log_full_errno(l == 0 ? LOG_DEBUG : LOG_WARNING,
+ SYNTHETIC_ERRNO(EIO),
+ "Short read while reading bind user UID pairs.");
+ }
+ }
}
if (arg_unified_cgroup_hierarchy == CGROUP_UNIFIED_UNKNOWN) {
if (!barrier_place_and_sync(&barrier)) /* #1 */
return log_error_errno(SYNTHETIC_ERRNO(ESRCH), "Child died too early.");
- r = setup_uid_map(*pid);
+ r = setup_uid_map(*pid, bind_user_uid, n_bind_user_uid);
if (r < 0)
return r;
projects / thirdparty / systemd.git / commitdiff
