[CRIU] [PATCH 06/11] userns: restore gid and uid maps

[Andrey Vagin]

Signed-off-by: Andrey Vagin <avagin at openvz.org>
---
 cr-restore.c         |  9 +++++++++
 include/namespaces.h |  2 ++
 namespaces.c         | 45 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)

diff --git a/cr-restore.c b/cr-restore.c
index 3c36323..9abb1c3 100644
--- a/cr-restore.c
+++ b/cr-restore.c
@@ -1346,6 +1346,12 @@ static int restore_task_with_children(void *_arg)
 		if (restore_finish_stage(CR_STATE_RESTORE_NS) < 0)
 			exit(1);
 
+		/* UID and GID must be set after restoring /proc/PID/{uid,gid}_maps */
+		if ((ca->clone_flags & CLONE_NEWUSER) && (setuid(0) || setgid(0))) {
+			pr_perror("Unable to initialize id-s");
+			exit(1);
+		}
+
 		if (prepare_namespace(current, ca->clone_flags))
 			exit(1);
 
@@ -1625,6 +1631,9 @@ static int restore_root_task(struct pstree_item *init)
 		}
 	}
 
+	if ((root_ns_mask & CLONE_NEWUSER) && prepare_userns(init))
+		goto out;
+
 	pr_info("Wait until namespaces are created\n");
 	ret = restore_wait_inprogress_tasks();
 	if (ret)
diff --git a/include/namespaces.h b/include/namespaces.h
index 350b8b4..8273fcd 100644
--- a/include/namespaces.h
+++ b/include/namespaces.h
@@ -56,4 +56,6 @@ extern struct ns_id *lookup_ns_by_id(unsigned int id, struct ns_desc *nd);
 
 extern int gen_predump_ns_mask(void);
 
+int prepare_userns(struct pstree_item *item);
+
 #endif /* __CR_NS_H__ */
diff --git a/namespaces.c b/namespaces.c
index 3ac9153..a7624d2 100644
--- a/namespaces.c
+++ b/namespaces.c
@@ -625,6 +625,51 @@ int dump_namespaces(struct pstree_item *item, unsigned int ns_flags)
 	return 0;
 }
 
+static int write_id_map(pid_t pid, UidGidExtent **extents, int n, char *id_map)
+{
+	char buf[PAGE_SIZE];
+	int off = 0, i;
+	int fd;
+
+	for (i = 0; i < n; i++)
+		off += snprintf(buf + off, sizeof(buf) - off,
+				"%d %d %d", extents[i]->first,
+					extents[i]->lower_first,
+					extents[i]->count);
+
+	fd = open_proc_rw(pid, "%s", id_map);
+	if (fd < 0)
+		return -1;
+	if (write(fd, buf, off) != off) {
+		pr_perror("Unable to write into %s\n", id_map);
+		close(fd);
+		return -1;
+	}
+	close(fd);
+
+	return 0;
+}
+
+int prepare_userns(struct pstree_item *item)
+{
+	UsernsEntry *e;
+	int fd, ret;
+
+	fd = open_image(CR_FD_USERNS, O_RSTR, item->ids->user_ns_id);
+	ret = pb_read_one(fd, &e, PB_USERNS);
+	close(fd);
+	if (ret < 0)
+		return -1;
+
+	if (write_id_map(item->pid.real, e->uid_map, e->n_uid_map, "uid_map"))
+		return -1;
+
+	if (write_id_map(item->pid.real, e->gid_map, e->n_gid_map, "gid_map"))
+		return -1;
+
+	return 0;
+}
+
 int prepare_namespace(struct pstree_item *item, unsigned long clone_flags)
 {
 	pid_t pid = item->pid.virt;
-- 
1.9.3