[CRIU] [PATCH 5/5] userns: restore gid and uid maps

[Andrey Vagin]

Signed-off-by: Andrey Vagin <avagin at openvz.org>
---
 cr-restore.c         |  9 +++++++++
 include/namespaces.h |  2 ++
 namespaces.c         | 45 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)

diff --git a/cr-restore.c b/cr-restore.c
index afc3656..7d02812 100644
--- a/cr-restore.c
+++ b/cr-restore.c
@@ -1236,6 +1236,12 @@ static int restore_task_with_children(void *_arg)
 		if (restore_finish_stage(CR_STATE_RESTORE_NS) < 0)
 			exit(1);
 
+		/* UID and GID must be set after restoring /proc/PID/{uid,gid}_maps */
+		if (setuid(0) || setgid(0)) {
+			pr_perror("Unable to initialize id-s");
+			exit(1);
+		}
+
 		if (collect_mount_info(getpid()))
 			exit(1);
 
@@ -1482,6 +1488,9 @@ static int restore_root_task(struct pstree_item *init)
 	if (ret < 0)
 		return -1;
 
+	if ((current_ns_mask & CLONE_NEWUSER) && prepare_userns(init))
+		goto out;
+
 	pr_info("Wait until namespaces are created\n");
 	ret = restore_wait_inprogress_tasks();
 	if (ret)
diff --git a/include/namespaces.h b/include/namespaces.h
index 9fb5c06..fbcaf5d 100644
--- a/include/namespaces.h
+++ b/include/namespaces.h
@@ -35,4 +35,6 @@ extern int restore_ns(int rst, struct ns_desc *nd);
 extern int dump_task_ns_ids(struct pstree_item *);
 extern int gen_predump_ns_mask(void);
 
+int prepare_userns(struct pstree_item *item);
+
 #endif /* __CR_NS_H__ */
diff --git a/namespaces.c b/namespaces.c
index 524b47b..1be3faf 100644
--- a/namespaces.c
+++ b/namespaces.c
@@ -601,6 +601,51 @@ int dump_namespaces(struct pstree_item *item, unsigned int ns_flags)
 	return 0;
 }
 
+static int write_id_map(pid_t pid, UidGidExtent **extents, int n, char *id_map)
+{
+	char buf[PAGE_SIZE];
+	int off = 0, i;
+	int fd;
+
+	for (i = 0; i < n; i++)
+		off += snprintf(buf + off, sizeof(buf) - off,
+				"%d %d %d", extents[i]->first,
+					extents[i]->lower_first,
+					extents[i]->count);
+
+	fd = open_proc_rw(pid, "%s", id_map);
+	if (fd < 0)
+		return -1;
+	if (write(fd, buf, off) != off) {
+		pr_perror("Unable to write into %s\n", id_map);
+		close(fd);
+		return -1;
+	}
+	close(fd);
+
+	return 0;
+}
+
+int prepare_userns(struct pstree_item *item)
+{
+	UsernsEntry *e;
+	int fd, ret;
+
+	fd = open_image(CR_FD_USERNS, O_RSTR, item->ids->user_ns_id);
+	ret = pb_read_one(fd, &e, PB_USERNS);
+	close(fd);
+	if (ret < 0)
+		return -1;
+
+	if (write_id_map(item->pid.real, e->uid_map, e->n_uid_map, "uid_map"))
+		return -1;
+
+	if (write_id_map(item->pid.real, e->gid_map, e->n_gid_map, "gid_map"))
+		return -1;
+
+	return 0;
+}
+
 int prepare_namespace(struct pstree_item *item, unsigned long clone_flags)
 {
 	pid_t pid = item->pid.virt;
-- 
1.8.5.3