[CRIU] [PATCH 08/14] dump: dump user namespaces
Pavel Emelyanov
xemul at parallels.com
Tue Oct 14 08:18:07 PDT 2014
On 10/14/2014 03:38 PM, Andrey Vagin wrote:
> For that we need to save per-namespace mappings of user and group IDs.
>
> And all id-s for tasks and files are saved from the target user
> namespace.
>
> Signed-off-by: Andrey Vagin <avagin at openvz.org>
> ---
> cr-dump.c | 11 ++++
> include/namespaces.h | 3 ++
> namespaces.c | 140 +++++++++++++++++++++++++++++++++++++++++++++++----
> 3 files changed, 145 insertions(+), 9 deletions(-)
>
> diff --git a/cr-dump.c b/cr-dump.c
> index ed7de5f..3959807 100644
> --- a/cr-dump.c
> +++ b/cr-dump.c
> @@ -1842,6 +1842,16 @@ int cr_dump_tasks(pid_t pid)
> if (collect_namespaces(true) < 0)
> goto err;
>
> + if (root_ns_mask & CLONE_NEWUSER) {
> + /*
> + * User namespace is dumped before files to get uid and gid
> + * mappings, which are used for convirting local id-s to
> + * userns id-s (userns_uid(), userns_gid())
> + */
> + if (dump_user_ns(root_item->pid.real, root_item->ids->user_ns_id))
This heavily uses the fact, that nsid generator makes sure there's only
one userns. What are the problems to support multiple user namespaces
from the very beginning?
> + goto err;
> + }
> +
> glob_imgset = cr_glob_imgset_open(O_DUMP);
> if (!glob_imgset)
> goto err;
> @@ -1947,6 +1957,7 @@ err:
> free_file_locks();
> free_link_remaps();
> free_aufs_branches();
> + free_userns_maps();
>
> close_service_fd(CR_PROC_FD_OFF);
>
> diff --git a/include/namespaces.h b/include/namespaces.h
> index d2f3e76..5b1c6fb 100644
> --- a/include/namespaces.h
> +++ b/include/namespaces.h
> @@ -62,7 +62,10 @@ extern struct ns_id *rst_new_ns_id(unsigned int id, pid_t pid, struct ns_desc *n
> extern int rst_add_ns_id(unsigned int id, pid_t pid, struct ns_desc *nd);
> extern struct ns_id *lookup_ns_by_id(unsigned int id, struct ns_desc *nd);
>
> +extern int prepare_userns(struct pstree_item *item);
> extern int userns_uid(int uid);
> extern int userns_gid(int gid);
> +extern int dump_user_ns(pid_t pid, int ns_id);
> +extern void free_userns_maps(void);
>
> #endif /* __CR_NS_H__ */
> diff --git a/namespaces.c b/namespaces.c
> index 918729b..7bc4ced 100644
> --- a/namespaces.c
> +++ b/namespaces.c
> @@ -15,6 +15,7 @@
>
> #include "protobuf.h"
> #include "protobuf/ns.pb-c.h"
> +#include "protobuf/userns.pb-c.h"
>
> static struct ns_desc *ns_desc_array[] = {
> &net_ns_desc,
> @@ -438,27 +439,149 @@ int dump_task_ns_ids(struct pstree_item *item)
> return 0;
> }
>
> -static int userns_id(int id)
> +static UsernsEntry userns_entry = USERNS_ENTRY__INIT;
> +
> +static int userns_id(int id, UidGidExtent **map, int n)
> {
> - return id;
> + int i;
> +
> + if (!(root_ns_mask & CLONE_NEWUSER))
> + return id;
> +
> + for (i = 0; i < n; i++) {
> + if (map[i]->lower_first <= id &&
> + map[i]->lower_first + map[i]->count > id)
> + return map[i]->first + (id - map[i]->lower_first);
> + }
> +
> + return -1;
> }
>
> int userns_uid(int uid)
> {
> - return userns_id(uid);
> + UsernsEntry *e = &userns_entry;
> + return userns_id(uid, e->uid_map, e->n_uid_map);
> }
>
> int userns_gid(int gid)
> {
> - return userns_id(gid);
> + UsernsEntry *e = &userns_entry;
> + return userns_id(gid, e->gid_map, e->n_gid_map);
> }
>
> -static int dump_user_ns(pid_t pid, int ns_id)
> +static int parse_id_map(pid_t pid, char *name, UidGidExtent ***pb_exts)
> {
> - pr_err("User namesapces are not supported yet\n");
> + UidGidExtent *extents = NULL;
> + int len = 0, size = 0, ret, i;
> + FILE *f;
> +
> + f = fopen_proc(pid, "%s", name);
> + if (f == NULL)
> + return -1;
> +
> + ret = -1;
> + while (1) {
> + UidGidExtent *ext;
> +
> + if (len == size) {
> + UidGidExtent *t;
> +
> + size = size * 2 + 1;
> + t = xrealloc(extents, size * sizeof(UidGidExtent));
> + if (t == NULL)
> + break;
> + extents = t;
> + }
> +
> + ext = &extents[len];
> +
> + uid_gid_extent__init(ext);
> + ret = fscanf(f, "%d %d %d", &ext->first,
> + &ext->lower_first, &ext->count);
> + if (ret != 3) {
> + if (errno != 0) {
> + pr_perror("Unable to parse extents");
> + ret = -1;
> + } else
> + ret = 0;
> + break;
> + }
> + pr_info("id_map: %d %d %d\n", ext->first, ext->lower_first, ext->count);
> + len++;
> + }
> +
> + fclose(f);
> +
> + if (ret)
> + goto err;
> +
> + if (len) {
> + *pb_exts = xmalloc(sizeof(UidGidExtent *) * len);
> + if (*pb_exts == NULL)
> + goto err;
> +
> + for (i = 0; i < len; i++)
> + (*pb_exts)[i] = &extents[i];
> + } else {
> + xfree(extents);
> + *pb_exts = NULL;
> + }
> +
> + return len;
> +err:
> + xfree(extents);
> return -1;
> }
>
> +int dump_user_ns(pid_t pid, int ns_id)
> +{
> + int ret, exit_code = -1;
> + UsernsEntry *e = &userns_entry;
> + struct cr_img *img;
> +
> + ret = parse_id_map(pid, "uid_map", &e->uid_map);
> + if (ret < 0)
> + goto err;
> + e->n_uid_map = ret;
> +
> + ret = parse_id_map(pid, "gid_map", &e->gid_map);
> + if (ret < 0)
> + goto err;
> + e->n_gid_map = ret;
> +
> + img = open_image(CR_FD_USERNS, O_DUMP, ns_id);
> + if (!img)
> + goto err;
> + ret = pb_write_one(img, e, PB_USERNS);
> + close_image(img);
> + if (ret < 0)
> + goto err;
> +
> + return 0;
> +err:
> + if (e->uid_map) {
> + xfree(e->uid_map[0]);
> + xfree(e->uid_map);
> + }
> + if (e->gid_map) {
> + xfree(e->gid_map[0]);
> + xfree(e->gid_map);
> + }
> + return exit_code;
> +}
> +
> +void free_userns_maps()
> +{
> + if (userns_entry.n_uid_map > 0) {
> + xfree(userns_entry.uid_map[0]);
> + xfree(userns_entry.uid_map);
> + }
> + if (userns_entry.n_gid_map > 0) {
> + xfree(userns_entry.gid_map[0]);
> + xfree(userns_entry.gid_map);
> + }
> +}
> +
> static int do_dump_namespaces(struct ns_id *ns)
> {
> int ret;
> @@ -484,9 +607,8 @@ static int do_dump_namespaces(struct ns_id *ns)
> ret = dump_net_ns(ns->id);
> break;
> case CLONE_NEWUSER:
> - pr_info("Dump USER namespace info %d via %d\n",
> - ns->id, ns->pid);
> - ret = dump_user_ns(ns->pid, ns->id);
> + /* userns is dumped before dumping tasks */
> + ret = 0;
> break;
> default:
> pr_err("Unknown namespace flag %x", ns->nd->cflag);
>
More information about the CRIU
mailing list