[CRIU] [PATCH 08/14] dump: dump user namespaces
Andrey Vagin
avagin at openvz.org
Tue Oct 14 04:38:22 PDT 2014
For that we need to save per-namespace mappings of user and group IDs.
And all id-s for tasks and files are saved from the target user
namespace.
Signed-off-by: Andrey Vagin <avagin at openvz.org>
---
cr-dump.c | 11 ++++
include/namespaces.h | 3 ++
namespaces.c | 140 +++++++++++++++++++++++++++++++++++++++++++++++----
3 files changed, 145 insertions(+), 9 deletions(-)
diff --git a/cr-dump.c b/cr-dump.c
index ed7de5f..3959807 100644
--- a/cr-dump.c
+++ b/cr-dump.c
@@ -1842,6 +1842,16 @@ int cr_dump_tasks(pid_t pid)
if (collect_namespaces(true) < 0)
goto err;
+ if (root_ns_mask & CLONE_NEWUSER) {
+ /*
+ * User namespace is dumped before files to get uid and gid
+ * mappings, which are used for convirting local id-s to
+ * userns id-s (userns_uid(), userns_gid())
+ */
+ if (dump_user_ns(root_item->pid.real, root_item->ids->user_ns_id))
+ goto err;
+ }
+
glob_imgset = cr_glob_imgset_open(O_DUMP);
if (!glob_imgset)
goto err;
@@ -1947,6 +1957,7 @@ err:
free_file_locks();
free_link_remaps();
free_aufs_branches();
+ free_userns_maps();
close_service_fd(CR_PROC_FD_OFF);
diff --git a/include/namespaces.h b/include/namespaces.h
index d2f3e76..5b1c6fb 100644
--- a/include/namespaces.h
+++ b/include/namespaces.h
@@ -62,7 +62,10 @@ extern struct ns_id *rst_new_ns_id(unsigned int id, pid_t pid, struct ns_desc *n
extern int rst_add_ns_id(unsigned int id, pid_t pid, struct ns_desc *nd);
extern struct ns_id *lookup_ns_by_id(unsigned int id, struct ns_desc *nd);
+extern int prepare_userns(struct pstree_item *item);
extern int userns_uid(int uid);
extern int userns_gid(int gid);
+extern int dump_user_ns(pid_t pid, int ns_id);
+extern void free_userns_maps(void);
#endif /* __CR_NS_H__ */
diff --git a/namespaces.c b/namespaces.c
index 918729b..7bc4ced 100644
--- a/namespaces.c
+++ b/namespaces.c
@@ -15,6 +15,7 @@
#include "protobuf.h"
#include "protobuf/ns.pb-c.h"
+#include "protobuf/userns.pb-c.h"
static struct ns_desc *ns_desc_array[] = {
&net_ns_desc,
@@ -438,27 +439,149 @@ int dump_task_ns_ids(struct pstree_item *item)
return 0;
}
-static int userns_id(int id)
+static UsernsEntry userns_entry = USERNS_ENTRY__INIT;
+
+static int userns_id(int id, UidGidExtent **map, int n)
{
- return id;
+ int i;
+
+ if (!(root_ns_mask & CLONE_NEWUSER))
+ return id;
+
+ for (i = 0; i < n; i++) {
+ if (map[i]->lower_first <= id &&
+ map[i]->lower_first + map[i]->count > id)
+ return map[i]->first + (id - map[i]->lower_first);
+ }
+
+ return -1;
}
int userns_uid(int uid)
{
- return userns_id(uid);
+ UsernsEntry *e = &userns_entry;
+ return userns_id(uid, e->uid_map, e->n_uid_map);
}
int userns_gid(int gid)
{
- return userns_id(gid);
+ UsernsEntry *e = &userns_entry;
+ return userns_id(gid, e->gid_map, e->n_gid_map);
}
-static int dump_user_ns(pid_t pid, int ns_id)
+static int parse_id_map(pid_t pid, char *name, UidGidExtent ***pb_exts)
{
- pr_err("User namesapces are not supported yet\n");
+ UidGidExtent *extents = NULL;
+ int len = 0, size = 0, ret, i;
+ FILE *f;
+
+ f = fopen_proc(pid, "%s", name);
+ if (f == NULL)
+ return -1;
+
+ ret = -1;
+ while (1) {
+ UidGidExtent *ext;
+
+ if (len == size) {
+ UidGidExtent *t;
+
+ size = size * 2 + 1;
+ t = xrealloc(extents, size * sizeof(UidGidExtent));
+ if (t == NULL)
+ break;
+ extents = t;
+ }
+
+ ext = &extents[len];
+
+ uid_gid_extent__init(ext);
+ ret = fscanf(f, "%d %d %d", &ext->first,
+ &ext->lower_first, &ext->count);
+ if (ret != 3) {
+ if (errno != 0) {
+ pr_perror("Unable to parse extents");
+ ret = -1;
+ } else
+ ret = 0;
+ break;
+ }
+ pr_info("id_map: %d %d %d\n", ext->first, ext->lower_first, ext->count);
+ len++;
+ }
+
+ fclose(f);
+
+ if (ret)
+ goto err;
+
+ if (len) {
+ *pb_exts = xmalloc(sizeof(UidGidExtent *) * len);
+ if (*pb_exts == NULL)
+ goto err;
+
+ for (i = 0; i < len; i++)
+ (*pb_exts)[i] = &extents[i];
+ } else {
+ xfree(extents);
+ *pb_exts = NULL;
+ }
+
+ return len;
+err:
+ xfree(extents);
return -1;
}
+int dump_user_ns(pid_t pid, int ns_id)
+{
+ int ret, exit_code = -1;
+ UsernsEntry *e = &userns_entry;
+ struct cr_img *img;
+
+ ret = parse_id_map(pid, "uid_map", &e->uid_map);
+ if (ret < 0)
+ goto err;
+ e->n_uid_map = ret;
+
+ ret = parse_id_map(pid, "gid_map", &e->gid_map);
+ if (ret < 0)
+ goto err;
+ e->n_gid_map = ret;
+
+ img = open_image(CR_FD_USERNS, O_DUMP, ns_id);
+ if (!img)
+ goto err;
+ ret = pb_write_one(img, e, PB_USERNS);
+ close_image(img);
+ if (ret < 0)
+ goto err;
+
+ return 0;
+err:
+ if (e->uid_map) {
+ xfree(e->uid_map[0]);
+ xfree(e->uid_map);
+ }
+ if (e->gid_map) {
+ xfree(e->gid_map[0]);
+ xfree(e->gid_map);
+ }
+ return exit_code;
+}
+
+void free_userns_maps()
+{
+ if (userns_entry.n_uid_map > 0) {
+ xfree(userns_entry.uid_map[0]);
+ xfree(userns_entry.uid_map);
+ }
+ if (userns_entry.n_gid_map > 0) {
+ xfree(userns_entry.gid_map[0]);
+ xfree(userns_entry.gid_map);
+ }
+}
+
static int do_dump_namespaces(struct ns_id *ns)
{
int ret;
@@ -484,9 +607,8 @@ static int do_dump_namespaces(struct ns_id *ns)
ret = dump_net_ns(ns->id);
break;
case CLONE_NEWUSER:
- pr_info("Dump USER namespace info %d via %d\n",
- ns->id, ns->pid);
- ret = dump_user_ns(ns->pid, ns->id);
+ /* userns is dumped before dumping tasks */
+ ret = 0;
break;
default:
pr_err("Unknown namespace flag %x", ns->nd->cflag);
--
1.9.3
More information about the CRIU
mailing list