mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

isolation: Refactor isolate_user() to allow for a common exit path

Browse source 
Currently, isolate_user() exits early if the --netns-only option is given.
That works for now, but shortly we're going to want to add some logic to
go at the end of isolate_user() that needs to run in all cases: joining a
given userns, creating a new userns, or staying in our original userns
(--netns-only).

To avoid muddying those changes, here we reorganize isolate_user() to have
a common exit path for all cases.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
David Gibson 2022-10-14 15:25:33 +11:00 committed by Stefano Brivio
parent ea5936dd3f
commit ceb2061587
1 changed files with 16 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
isolation.c
View file

@ -130,9 +130,6 @@ void isolate_initial(void)
*/ */
void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns) void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns)
{ {
char uidmap[BUFSIZ];
char gidmap[BUFSIZ];
/* First set our UID & GID in the original namespace */ /* First set our UID & GID in the original namespace */
if (setgroups(0, NULL)) { if (setgroups(0, NULL)) {
/* If we don't have CAP_SETGID, this will EPERM */ /* If we don't have CAP_SETGID, this will EPERM */
@ -153,12 +150,7 @@ void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns)
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
} }
/* If we're told not to use a userns, nothing more to do */ if (*userns) { /* If given a userns, join it */
if (!use_userns)
return;
/* Otherwise, if given a userns, join it */
if (*userns) {
int ufd; int ufd;
ufd = open(userns, O_RDONLY | O_CLOEXEC); ufd = open(userns, O_RDONLY | O_CLOEXEC);
@ -175,24 +167,24 @@ void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns)
} }
close(ufd); close(ufd);
} else if (use_userns) { /* Create and join a new userns */
char uidmap[BUFSIZ];
char gidmap[BUFSIZ];
return; if (unshare(CLONE_NEWUSER) != 0) {
} err("Couldn't create user namespace: %s", strerror(errno));
exit(EXIT_FAILURE);
}
/* Otherwise, create our own userns */ /* Configure user and group mappings */
if (unshare(CLONE_NEWUSER) != 0) { snprintf(uidmap, BUFSIZ, "0 %u 1", uid);
err("Couldn't create user namespace: %s", strerror(errno)); snprintf(gidmap, BUFSIZ, "0 %u 1", gid);
exit(EXIT_FAILURE);
}
/* Configure user and group mappings */ if (write_file("/proc/self/uid_map", uidmap) ||
snprintf(uidmap, BUFSIZ, "0 %u 1", uid); write_file("/proc/self/setgroups", "deny") ||
snprintf(gidmap, BUFSIZ, "0 %u 1", gid); write_file("/proc/self/gid_map", gidmap)) {
warn("Couldn't configure user namespace");
if (write_file("/proc/self/uid_map", uidmap) || }
write_file("/proc/self/setgroups", "deny") ||
write_file("/proc/self/gid_map", gidmap)) {
warn("Couldn't configure user namespace");
} }
} }