[CRIU] [PATCH] userns: restore per-namespace mappings of user and group IDs (v2)

[Serge Hallyn]

Quoting Andrey Vagin (avagin at openvz.org):
> In this patch we fill /proc/PID/uid_map and /proc/PID/gid_map for the
> root task.
> 
> v2: initialize groups in a new namespace.
> Signed-off-by: Andrey Vagin <avagin at openvz.org>

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  cr-restore.c | 11 +++++++++++
>  namespaces.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 63 insertions(+)
> 
> diff --git a/cr-restore.c b/cr-restore.c
> index 7ca80ba..36af267 100644
> --- a/cr-restore.c
> +++ b/cr-restore.c
> @@ -1416,6 +1416,14 @@ static int restore_task_with_children(void *_arg)
>  		if (restore_finish_stage(CR_STATE_RESTORE_NS) < 0)
>  			goto err;
>  
> +		/* UID and GID must be set after restoring /proc/PID/{uid,gid}_maps */
> +		if (ca->clone_flags & CLONE_NEWUSER) {
> +			if (setuid(0) || setgid(0) || setgroups(0, NULL)) {
> +				pr_perror("Unable to initialize id-s");
> +				exit(1);
> +			}
> +		}
> +
>  		if (prepare_namespace(current, ca->clone_flags))
>  			goto err_fini_mnt;
>  
> @@ -1710,6 +1718,9 @@ static int restore_root_task(struct pstree_item *init)
>  		}
>  	}
>  
> +	if ((root_ns_mask & CLONE_NEWUSER) && prepare_userns(init))
> +		goto out;
> +
>  	pr_info("Wait until namespaces are created\n");
>  	ret = restore_wait_inprogress_tasks();
>  	if (ret)
> diff --git a/namespaces.c b/namespaces.c
> index 7bc4ced..d2f631a 100644
> --- a/namespaces.c
> +++ b/namespaces.c
> @@ -692,6 +692,58 @@ int dump_namespaces(struct pstree_item *item, unsigned int ns_flags)
>  	return 0;
>  }
>  
> +static int write_id_map(pid_t pid, UidGidExtent **extents, int n, char *id_map)
> +{
> +	char buf[PAGE_SIZE];
> +	int off = 0, i;
> +	int fd;
> +
> +	/*
> +	 *  We can perform only a single write (that may contain multiple
> +	 *  newline-delimited records) to a uid_map and a gid_map files.
> +	 */
> +	for (i = 0; i < n; i++)
> +		off += snprintf(buf + off, sizeof(buf) - off,
> +				"%d %d %d\n", extents[i]->first,
> +					extents[i]->lower_first,
> +					extents[i]->count);
> +
> +	fd = open_proc_rw(pid, "%s", id_map);
> +	if (fd < 0)
> +		return -1;
> +	if (write(fd, buf, off) != off) {
> +		pr_perror("Unable to write into %s\n", id_map);
> +		close(fd);
> +		return -1;
> +	}
> +	close(fd);
> +
> +	return 0;
> +}
> +
> +int prepare_userns(struct pstree_item *item)
> +{
> +	struct cr_img *img;
> +	UsernsEntry *e;
> +	int ret;
> +
> +	img = open_image(CR_FD_USERNS, O_RSTR, item->ids->user_ns_id);
> +	if (!img)
> +		return -1;
> +	ret = pb_read_one(img, &e, PB_USERNS);
> +	close_image(img);
> +	if (ret < 0)
> +		return -1;
> +
> +	if (write_id_map(item->pid.real, e->uid_map, e->n_uid_map, "uid_map"))
> +		return -1;
> +
> +	if (write_id_map(item->pid.real, e->gid_map, e->n_gid_map, "gid_map"))
> +		return -1;
> +
> +	return 0;
> +}
> +
>  int collect_namespaces(bool for_dump)
>  {
>  	int ret;
> -- 
> 1.9.3
>