[CRIU] [PATCH 5/5] userns: restore gid and uid maps

[Andrew Vagin]

On Tue, Feb 11, 2014 at 08:50:35AM +0400, Pavel Emelyanov wrote:
> On 02/11/2014 12:58 AM, Andrey Vagin wrote:
> > Signed-off-by: Andrey Vagin <avagin at openvz.org>
> > ---
> >  cr-restore.c         |  9 +++++++++
> >  include/namespaces.h |  2 ++
> >  namespaces.c         | 45 +++++++++++++++++++++++++++++++++++++++++++++
> >  3 files changed, 56 insertions(+)
> > 
> > diff --git a/cr-restore.c b/cr-restore.c
> > index afc3656..7d02812 100644
> > --- a/cr-restore.c
> > +++ b/cr-restore.c
> > @@ -1236,6 +1236,12 @@ static int restore_task_with_children(void *_arg)
> >  		if (restore_finish_stage(CR_STATE_RESTORE_NS) < 0)
> >  			exit(1);
> >  
> > +		/* UID and GID must be set after restoring /proc/PID/{uid,gid}_maps */
> 
> Who did it _before_ this code?

It is required for userns only, but it does nothing in other cases.

> 
> > +		if (setuid(0) || setgid(0)) {
> > +			pr_perror("Unable to initialize id-s");
> > +			exit(1);
> > +		}
> > +
> >  		if (collect_mount_info(getpid()))
> >  			exit(1);
> >  
> > @@ -1482,6 +1488,9 @@ static int restore_root_task(struct pstree_item *init)
> >  	if (ret < 0)
> >  		return -1;
> >  
> > +	if ((current_ns_mask & CLONE_NEWUSER) && prepare_userns(init))
> 
> Who will put CLONE_NEWUSER bit into current_ns_mask on restore? I see
> no such changes in get_clone_mask() and around.

[PATCH]  namespaces: take into account USERNS id

> 
> > +		goto out;
> > +
> >  	pr_info("Wait until namespaces are created\n");
> >  	ret = restore_wait_inprogress_tasks();
> >  	if (ret)
> > diff --git a/include/namespaces.h b/include/namespaces.h
> > index 9fb5c06..fbcaf5d 100644
> > --- a/include/namespaces.h
> > +++ b/include/namespaces.h
> > @@ -35,4 +35,6 @@ extern int restore_ns(int rst, struct ns_desc *nd);
> >  extern int dump_task_ns_ids(struct pstree_item *);
> >  extern int gen_predump_ns_mask(void);
> >  
> > +int prepare_userns(struct pstree_item *item);
> > +
> >  #endif /* __CR_NS_H__ */
> > diff --git a/namespaces.c b/namespaces.c
> > index 524b47b..1be3faf 100644
> > --- a/namespaces.c
> > +++ b/namespaces.c
> > @@ -601,6 +601,51 @@ int dump_namespaces(struct pstree_item *item, unsigned int ns_flags)
> >  	return 0;
> >  }
> >  
> > +static int write_id_map(pid_t pid, UidGidExtent **extents, int n, char *id_map)
> > +{
> > +	char buf[PAGE_SIZE];
> > +	int off = 0, i;
> > +	int fd;
> > +
> > +	for (i = 0; i < n; i++)
> > +		off += snprintf(buf + off, sizeof(buf) - off,
> > +				"%d %d %d", extents[i]->first,
> > +					extents[i]->lower_first,
> > +					extents[i]->count);
> 
> Maybe use fopen_proc for that? This would avoid allocating
> one more buffer on the stack.

Ok.

The buffer will be allocated in glibc;).

> 
> > +
> > +	fd = open_proc_rw(pid, "%s", id_map);
> > +	if (fd < 0)
> > +		return -1;
> > +	if (write(fd, buf, off) != off) {
> > +		pr_perror("Unable to write into %s\n", id_map);
> > +		close(fd);
> > +		return -1;
> > +	}
> > +	close(fd);
> > +
> > +	return 0;
> > +}
> > +
> > +int prepare_userns(struct pstree_item *item)
> > +{
> > +	UsernsEntry *e;
> > +	int fd, ret;
> > +
> > +	fd = open_image(CR_FD_USERNS, O_RSTR, item->ids->user_ns_id);
> > +	ret = pb_read_one(fd, &e, PB_USERNS);
> > +	close(fd);
> > +	if (ret < 0)
> > +		return -1;
> > +
> > +	if (write_id_map(item->pid.real, e->uid_map, e->n_uid_map, "uid_map"))
> > +		return -1;
> > +
> > +	if (write_id_map(item->pid.real, e->gid_map, e->n_gid_map, "gid_map"))
> > +		return -1;
> > +
> > +	return 0;
> > +}
> > +
> >  int prepare_namespace(struct pstree_item *item, unsigned long clone_flags)
> >  {
> >  	pid_t pid = item->pid.virt;
> > 
> 
>