[CRIU] [PATCH 5/5] userns: restore gid and uid maps

[Pavel Emelyanov]

On 02/11/2014 12:58 AM, Andrey Vagin wrote:
> Signed-off-by: Andrey Vagin <avagin at openvz.org>
> ---
>  cr-restore.c         |  9 +++++++++
>  include/namespaces.h |  2 ++
>  namespaces.c         | 45 +++++++++++++++++++++++++++++++++++++++++++++
>  3 files changed, 56 insertions(+)
> 
> diff --git a/cr-restore.c b/cr-restore.c
> index afc3656..7d02812 100644
> --- a/cr-restore.c
> +++ b/cr-restore.c
> @@ -1236,6 +1236,12 @@ static int restore_task_with_children(void *_arg)
>  		if (restore_finish_stage(CR_STATE_RESTORE_NS) < 0)
>  			exit(1);
>  
> +		/* UID and GID must be set after restoring /proc/PID/{uid,gid}_maps */

Who did it _before_ this code?

> +		if (setuid(0) || setgid(0)) {
> +			pr_perror("Unable to initialize id-s");
> +			exit(1);
> +		}
> +
>  		if (collect_mount_info(getpid()))
>  			exit(1);
>  
> @@ -1482,6 +1488,9 @@ static int restore_root_task(struct pstree_item *init)
>  	if (ret < 0)
>  		return -1;
>  
> +	if ((current_ns_mask & CLONE_NEWUSER) && prepare_userns(init))

Who will put CLONE_NEWUSER bit into current_ns_mask on restore? I see
no such changes in get_clone_mask() and around.

> +		goto out;
> +
>  	pr_info("Wait until namespaces are created\n");
>  	ret = restore_wait_inprogress_tasks();
>  	if (ret)
> diff --git a/include/namespaces.h b/include/namespaces.h
> index 9fb5c06..fbcaf5d 100644
> --- a/include/namespaces.h
> +++ b/include/namespaces.h
> @@ -35,4 +35,6 @@ extern int restore_ns(int rst, struct ns_desc *nd);
>  extern int dump_task_ns_ids(struct pstree_item *);
>  extern int gen_predump_ns_mask(void);
>  
> +int prepare_userns(struct pstree_item *item);
> +
>  #endif /* __CR_NS_H__ */
> diff --git a/namespaces.c b/namespaces.c
> index 524b47b..1be3faf 100644
> --- a/namespaces.c
> +++ b/namespaces.c
> @@ -601,6 +601,51 @@ int dump_namespaces(struct pstree_item *item, unsigned int ns_flags)
>  	return 0;
>  }
>  
> +static int write_id_map(pid_t pid, UidGidExtent **extents, int n, char *id_map)
> +{
> +	char buf[PAGE_SIZE];
> +	int off = 0, i;
> +	int fd;
> +
> +	for (i = 0; i < n; i++)
> +		off += snprintf(buf + off, sizeof(buf) - off,
> +				"%d %d %d", extents[i]->first,
> +					extents[i]->lower_first,
> +					extents[i]->count);

Maybe use fopen_proc for that? This would avoid allocating
one more buffer on the stack.

> +
> +	fd = open_proc_rw(pid, "%s", id_map);
> +	if (fd < 0)
> +		return -1;
> +	if (write(fd, buf, off) != off) {
> +		pr_perror("Unable to write into %s\n", id_map);
> +		close(fd);
> +		return -1;
> +	}
> +	close(fd);
> +
> +	return 0;
> +}
> +
> +int prepare_userns(struct pstree_item *item)
> +{
> +	UsernsEntry *e;
> +	int fd, ret;
> +
> +	fd = open_image(CR_FD_USERNS, O_RSTR, item->ids->user_ns_id);
> +	ret = pb_read_one(fd, &e, PB_USERNS);
> +	close(fd);
> +	if (ret < 0)
> +		return -1;
> +
> +	if (write_id_map(item->pid.real, e->uid_map, e->n_uid_map, "uid_map"))
> +		return -1;
> +
> +	if (write_id_map(item->pid.real, e->gid_map, e->n_gid_map, "gid_map"))
> +		return -1;
> +
> +	return 0;
> +}
> +
>  int prepare_namespace(struct pstree_item *item, unsigned long clone_flags)
>  {
>  	pid_t pid = item->pid.virt;
>