[CRIU] [PATCH 11/17] userns: restore per-namespace mappings of user and group IDs (v2)

[Andrey Vagin]

In this patch we fill /proc/PID/uid_map and /proc/PID/gid_map for the
root task.

v2: initialize groups in a new namespace.
Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

v3: add a helper to initialize creds in a new userns
Signed-off-by: Andrey Vagin <avagin at openvz.org>
---
 cr-restore.c | 17 +++++++++++++++++
 namespaces.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)

diff --git a/cr-restore.c b/cr-restore.c
index d046f4b..cdd5dce 100644
--- a/cr-restore.c
+++ b/cr-restore.c
@@ -1363,6 +1363,16 @@ static int create_children_and_session(void)
 	return 0;
 }
 
+static int init_userns_creads()
+{
+	if (setuid(0) || setgid(0) || setgroups(0, NULL)) {
+		pr_perror("Unable to initialize id-s");
+		return -1;
+	}
+
+	return 0;
+}
+
 static int restore_task_with_children(void *_arg)
 {
 	struct cr_clone_arg *ca = _arg;
@@ -1416,6 +1426,10 @@ static int restore_task_with_children(void *_arg)
 		if (restore_finish_stage(CR_STATE_RESTORE_NS) < 0)
 			goto err;
 
+		/* UID and GID must be set after restoring /proc/PID/{uid,gid}_maps */
+		if ((ca->clone_flags & CLONE_NEWUSER) && init_userns_creads())
+			goto err_fini_mnt;
+
 		if (prepare_namespace(current, ca->clone_flags))
 			goto err_fini_mnt;
 
@@ -1713,6 +1727,9 @@ static int restore_root_task(struct pstree_item *init)
 		}
 	}
 
+	if ((root_ns_mask & CLONE_NEWUSER) && prepare_userns(init))
+		goto out;
+
 	pr_info("Wait until namespaces are created\n");
 	ret = restore_wait_inprogress_tasks();
 	if (ret)
diff --git a/namespaces.c b/namespaces.c
index a9242ac..cc69aab 100644
--- a/namespaces.c
+++ b/namespaces.c
@@ -731,6 +731,58 @@ int dump_namespaces(struct pstree_item *item, unsigned int ns_flags)
 	return 0;
 }
 
+static int write_id_map(pid_t pid, UidGidExtent **extents, int n, char *id_map)
+{
+	char buf[PAGE_SIZE];
+	int off = 0, i;
+	int fd;
+
+	/*
+	 *  We can perform only a single write (that may contain multiple
+	 *  newline-delimited records) to a uid_map and a gid_map files.
+	 */
+	for (i = 0; i < n; i++)
+		off += snprintf(buf + off, sizeof(buf) - off,
+				"%d %d %d\n", extents[i]->first,
+					extents[i]->lower_first,
+					extents[i]->count);
+
+	fd = open_proc_rw(pid, "%s", id_map);
+	if (fd < 0)
+		return -1;
+	if (write(fd, buf, off) != off) {
+		pr_perror("Unable to write into %s\n", id_map);
+		close(fd);
+		return -1;
+	}
+	close(fd);
+
+	return 0;
+}
+
+int prepare_userns(struct pstree_item *item)
+{
+	struct cr_img *img;
+	UsernsEntry *e;
+	int ret;
+
+	img = open_image(CR_FD_USERNS, O_RSTR, item->ids->user_ns_id);
+	if (!img)
+		return -1;
+	ret = pb_read_one(img, &e, PB_USERNS);
+	close_image(img);
+	if (ret < 0)
+		return -1;
+
+	if (write_id_map(item->pid.real, e->uid_map, e->n_uid_map, "uid_map"))
+		return -1;
+
+	if (write_id_map(item->pid.real, e->gid_map, e->n_gid_map, "gid_map"))
+		return -1;
+
+	return 0;
+}
+
 int collect_namespaces(bool for_dump)
 {
 	int ret;
-- 
1.9.3