proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-15 02:19:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

idmap_add_id: fix broken behavior

Browse Source 
The geteuid() addition is being made the first element of the lxc_list,
but the first element is just a head whose entry is ignored.  Therefore
userns_exec_1() was starting its tasks without the caller's uid mapped
into the namespace.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
This commit is contained in:
Serge Hallyn 2014-01-23 22:23:24 -06:00 committed by Stéphane Graber
parent 9f2fd74c7b
commit 3ec1648d8e
1 changed files with 25 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
src/lxc/conf.c
View File

@ -2170,9 +2170,9 @@ static int setup_caps(struct lxc_list *caps)
DEBUG("drop capability '%s' (%d)", drop_entry, capid); DEBUG("drop capability '%s' (%d)", drop_entry, capid);
if (prctl(PR_CAPBSET_DROP, capid, 0, 0, 0)) { if (prctl(PR_CAPBSET_DROP, capid, 0, 0, 0)) {
SYSERROR("failed to remove %s capability", drop_entry); SYSERROR("failed to remove %s capability", drop_entry);
return -1; return -1;
} }
} }
@ -2240,9 +2240,9 @@ static int dropcaps_except(struct lxc_list *caps)
if (caplist[i]) if (caplist[i])
continue; continue;
if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0)) { if (prctl(PR_CAPBSET_DROP, i, 0, 0, 0)) {
SYSERROR("failed to remove capability %d", i); SYSERROR("failed to remove capability %d", i);
return -1; return -1;
} }
} }
DEBUG("capabilities have been setup"); DEBUG("capabilities have been setup");
@ -3135,7 +3135,7 @@ int lxc_map_ids(struct lxc_list *idmap, pid_t pid)
* Return true if id was found, false otherwise. * Return true if id was found, false otherwise.
*/ */
bool get_mapped_rootid(struct lxc_conf *conf, enum idtype idtype, bool get_mapped_rootid(struct lxc_conf *conf, enum idtype idtype,
unsigned long *val) unsigned long *val)
{ {
struct lxc_list *it; struct lxc_list *it;
struct id_map *map; struct id_map *map;
@ -3266,7 +3266,7 @@ int lxc_create_tty(const char *name, struct lxc_conf *conf)
DEBUG("allocated pty '%s' (%d/%d)", DEBUG("allocated pty '%s' (%d/%d)",
pty_info->name, pty_info->master, pty_info->slave); pty_info->name, pty_info->master, pty_info->slave);
/* Prevent leaking the file descriptors to the container */ /* Prevent leaking the file descriptors to the container */
fcntl(pty_info->master, F_SETFD, FD_CLOEXEC); fcntl(pty_info->master, F_SETFD, FD_CLOEXEC);
fcntl(pty_info->slave, F_SETFD, FD_CLOEXEC); fcntl(pty_info->slave, F_SETFD, FD_CLOEXEC);
@ -3969,29 +3969,31 @@ static struct lxc_list *idmap_add_id(struct lxc_conf *conf, uid_t uid)
struct lxc_list *new = NULL, *tmp, *it, *next; struct lxc_list *new = NULL, *tmp, *it, *next;
struct id_map *entry; struct id_map *entry;
new = malloc(sizeof(*new));
if (!new) {
ERROR("Out of memory building id map");
return NULL;
}
lxc_list_init(new);
if (hostid_mapped < 0) { if (hostid_mapped < 0) {
hostid_mapped = find_unmapped_nsuid(conf); hostid_mapped = find_unmapped_nsuid(conf);
if (hostid_mapped < 0) { if (hostid_mapped < 0)
ERROR("Could not find free uid to map"); goto err;
return NULL; tmp = malloc(sizeof(*tmp));
} if (!tmp)
new = malloc(sizeof(*new)); goto err;
if (!new) {
ERROR("Out of memory building id map");
return NULL;
}
entry = malloc(sizeof(*entry)); entry = malloc(sizeof(*entry));
if (!entry) { if (!entry) {
free(new); free(tmp);
ERROR("Out of memory building idmap entry"); goto err;
return NULL;
} }
new->elem = entry; tmp->elem = entry;
entry->idtype = ID_TYPE_UID; entry->idtype = ID_TYPE_UID;
entry->nsid = hostid_mapped; entry->nsid = hostid_mapped;
entry->hostid = (unsigned long)uid; entry->hostid = (unsigned long)uid;
entry->range = 1; entry->range = 1;
lxc_list_init(new); lxc_list_add_tail(new, tmp);
} }
lxc_list_for_each_safe(it, &conf->id_map, next) { lxc_list_for_each_safe(it, &conf->id_map, next) {
tmp = malloc(sizeof(*tmp)); tmp = malloc(sizeof(*tmp));
@ -4005,11 +4007,7 @@ static struct lxc_list *idmap_add_id(struct lxc_conf *conf, uid_t uid)
memset(entry, 0, sizeof(*entry)); memset(entry, 0, sizeof(*entry));
memcpy(entry, it->elem, sizeof(*entry)); memcpy(entry, it->elem, sizeof(*entry));
tmp->elem = entry; tmp->elem = entry;
if (!new) { lxc_list_add_tail(new, tmp);
new = tmp;
lxc_list_init(new);
} else
lxc_list_add_tail(new, tmp);
} }
return new; return new;