containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #16895 from giuseppe/always-create-userns-with-euid-not-0 

rootless: always create userns with euid != 0
This commit is contained in:
OpenShift Merge Robot 2022-12-20 09:51:52 -05:00 committed by GitHub
parent 56982a9236 1bac160960
commit db648dc005
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libpod/runtime.go
View File

@ -420,13 +420,14 @@ func makeRuntime(runtime *Runtime) (retErr error) {
} }
logrus.Debugf("Set libpod namespace to %q", runtime.config.Engine.Namespace) logrus.Debugf("Set libpod namespace to %q", runtime.config.Engine.Namespace)
hasCapSysAdmin, err := unshare.HasCapSysAdmin() needsUserns := os.Geteuid() != 0
if err != nil { if !needsUserns {
return err hasCapSysAdmin, err := unshare.HasCapSysAdmin()
if err != nil {
return err
}
needsUserns = !hasCapSysAdmin
} }
needsUserns := !hasCapSysAdmin
// Set up containers/storage // Set up containers/storage
var store storage.Store var store storage.Store
if needsUserns { if needsUserns {

9
pkg/rootless/rootless_linux.go
View File

@ -172,7 +172,7 @@ func joinUserAndMountNS(pid uint, pausePid string) (bool, int, error) {
if err != nil { if err != nil {
return false, 0, err return false, 0, err
} }
if hasCapSysAdmin || os.Getenv("_CONTAINERS_USERNS_CONFIGURED") != "" { if (os.Geteuid() == 0 && hasCapSysAdmin) || os.Getenv("_CONTAINERS_USERNS_CONFIGURED") != "" {
return false, 0, nil return false, 0, nil
} }
@ -223,6 +223,11 @@ func GetConfiguredMappings(quiet bool) ([]idtools.IDMap, []idtools.IDMap, error)
} }
func copyMappings(from, to string) error { func copyMappings(from, to string) error {
// when running as non-root always go through the newuidmap/newgidmap
// configuration since this is the expectation when running on Kubernetes
if os.Geteuid() != 0 {
return errors.New("copying mappings is allowed only for root")
}
content, err := os.ReadFile(from) content, err := os.ReadFile(from)
if err != nil { if err != nil {
return err return err
@ -243,7 +248,7 @@ func becomeRootInUserNS(pausePid, fileToRead string, fileOutput *os.File) (_ boo
return false, 0, err return false, 0, err
} }
if hasCapSysAdmin || os.Getenv("_CONTAINERS_USERNS_CONFIGURED") != "" { if (os.Geteuid() == 0 && hasCapSysAdmin) || os.Getenv("_CONTAINERS_USERNS_CONFIGURED") != "" {
if os.Getenv("_CONTAINERS_USERNS_CONFIGURED") == "init" { if os.Getenv("_CONTAINERS_USERNS_CONFIGURED") == "init" {
return false, 0, runInUser() return false, 0, runInUser()
} }