[CRIU] [PATCH 11/11] userns: save uid-s from a target userns

[Andrey Vagin]

v2: don't leak maps
    convert uids-s after may_dump()

Signed-off-by: Andrey Vagin <avagin at openvz.org>
---
 cr-dump.c            | 13 +++++++++-
 files-reg.c          |  4 +--
 include/namespaces.h |  6 ++++-
 namespaces.c         | 73 ++++++++++++++++++++++++++++++++++++++++------------
 4 files changed, 75 insertions(+), 21 deletions(-)

diff --git a/cr-dump.c b/cr-dump.c
index 1700d9d..7c0a5cf 100644
--- a/cr-dump.c
+++ b/cr-dump.c
@@ -1441,7 +1441,7 @@ static int dump_one_task(struct pstree_item *item)
 	pid_t pid = item->pid.real;
 	struct vm_area_list vmas;
 	struct parasite_ctl *parasite_ctl;
-	int ret = -1;
+	int ret = -1, i;
 	struct parasite_dump_misc misc;
 	struct cr_fdset *cr_fdset = NULL;
 	struct parasite_drain_fd *dfds = NULL;
@@ -1476,6 +1476,12 @@ static int dump_one_task(struct pstree_item *item)
 		goto err;
 	}
 
+	for (i = 0; i < 4; i++)
+		cr.uids[i] = userns_uid(cr.uids[i]);
+
+	for (i = 0; i < 4; i++)
+		cr.gids[i] = userns_gid(cr.gids[i]);
+
 	ret = collect_mappings(pid, &vmas);
 	if (ret) {
 		pr_err("Collect mappings (pid: %d) failed with %d\n", pid, ret);
@@ -1800,6 +1806,10 @@ int cr_dump_tasks(pid_t pid)
 	if (network_lock())
 		goto err;
 
+	if (root_ns_mask & CLONE_NEWUSER) {
+		if (dump_user_ns(root_item->pid.real, root_item->ids->user_ns_id))
+			goto err;
+	}
 	if (collect_file_locks())
 		goto err;
 
@@ -1910,6 +1920,7 @@ err:
 	free_pstree(root_item);
 	free_file_locks();
 	free_link_remaps();
+	free_userns_maps();
 
 	close_service_fd(CR_PROC_FD_OFF);
 
diff --git a/files-reg.c b/files-reg.c
index f6c32df..8c44e2a 100644
--- a/files-reg.c
+++ b/files-reg.c
@@ -271,8 +271,8 @@ static int dump_ghost_file(int _fd, u32 id, const struct stat *st, dev_t phys_de
 	if (img < 0)
 		return -1;
 
-	gfe.uid = st->st_uid;
-	gfe.gid = st->st_gid;
+	gfe.uid = userns_uid(st->st_uid);
+	gfe.gid = userns_gid(st->st_gid);
 	gfe.mode = st->st_mode;
 
 	gfe.has_dev = gfe.has_ino = true;
diff --git a/include/namespaces.h b/include/namespaces.h
index 8273fcd..fadc973 100644
--- a/include/namespaces.h
+++ b/include/namespaces.h
@@ -56,6 +56,10 @@ extern struct ns_id *lookup_ns_by_id(unsigned int id, struct ns_desc *nd);
 
 extern int gen_predump_ns_mask(void);
 
-int prepare_userns(struct pstree_item *item);
+extern int prepare_userns(struct pstree_item *item);
+extern int userns_uid(int uid);
+extern int userns_gid(int gid);
+extern int dump_user_ns(pid_t pid, int ns_id);
+extern void free_userns_maps(void);
 
 #endif /* __CR_NS_H__ */
diff --git a/namespaces.c b/namespaces.c
index 1b253eb..c80016c 100644
--- a/namespaces.c
+++ b/namespaces.c
@@ -500,42 +500,83 @@ err:
 	return -1;
 }
 
-static int dump_user_ns(pid_t pid, int ns_id)
+
+static UsernsEntry userns_entry = USERNS_ENTRY__INIT;
+
+static int userns_id(int id, UidGidExtent **map, int n)
+{
+	int i;
+
+	if (!(root_ns_mask & CLONE_NEWNS))
+		return id;
+
+	for (i = 0; i < n; i++) {
+		if (map[i]->lower_first <= id &&
+		    map[i]->lower_first + map[i]->count > id)
+			return map[i]->first + (id - map[i]->lower_first);
+	}
+
+	return -1;
+}
+
+int userns_uid(int uid)
+{
+	UsernsEntry *e = &userns_entry;
+	return userns_id(uid, e->uid_map, e->n_uid_map);
+}
+
+int userns_gid(int gid)
+{
+	UsernsEntry *e = &userns_entry;
+	return userns_id(gid, e->gid_map, e->n_gid_map);
+}
+
+int dump_user_ns(pid_t pid, int ns_id)
 {
-	UsernsEntry e = USERNS_ENTRY__INIT;
 	int fd, ret, exit_code = -1;
+	UsernsEntry *e = &userns_entry;
 
-	ret = parse_id_map(pid, "uid_map", &e.uid_map);
+	ret = parse_id_map(pid, "uid_map", &e->uid_map);
 	if (ret < 0)
 		goto err;
-	e.n_uid_map = ret;
+	e->n_uid_map = ret;
 
-	ret = parse_id_map(pid, "gid_map", &e.gid_map);
+	ret = parse_id_map(pid, "gid_map", &e->gid_map);
 	if (ret < 0)
 		goto err;
-	e.n_gid_map = ret;
+	e->n_gid_map = ret;
 
 	fd = open_image(CR_FD_USERNS, O_DUMP, ns_id);
 	if (fd < 0)
 		goto err;
-	ret = pb_write_one(fd, &e, PB_USERNS);
+	ret = pb_write_one(fd, e, PB_USERNS);
 	close(fd);
 	if (ret < 0)
 		goto err;
 
-	exit_code = 0;
+	return 0;
 err:
-	if (e.uid_map) {
-		xfree(e.uid_map[0]);
-		xfree(e.uid_map);
+	if (e->uid_map) {
+		xfree(e->uid_map[0]);
+		xfree(e->uid_map);
 	}
-	if (e.gid_map) {
-		xfree(e.gid_map[0]);
-		xfree(e.gid_map);
+	if (e->gid_map) {
+		xfree(e->gid_map[0]);
+		xfree(e->gid_map);
 	}
 	return exit_code;
 }
 
+void free_userns_maps()
+{
+	int i;
+
+	for (i = 0; i < userns_entry.n_uid_map; i++)
+		xfree(userns_entry.uid_map[i]);
+	for (i = 0; i < userns_entry.n_gid_map; i++)
+		xfree(userns_entry.gid_map[i]);
+}
+
 static int do_dump_namespaces(struct ns_id *ns)
 {
 	int ret = -1;
@@ -561,9 +602,7 @@ static int do_dump_namespaces(struct ns_id *ns)
 		ret = dump_net_ns(ns->pid, ns->id);
 		break;
 	case CLONE_NEWUSER:
-		pr_info("Dump USER namespace info %d via %d\n",
-				ns->id, ns->pid);
-		ret = dump_user_ns(ns->pid, ns->id);
+		ret = 0;
 		break;
 	default:
 		pr_err("Unknown namespace flag %x", ns->nd->cflag);
-- 
1.9.3