The following pull request was submitted through Github.
It can be accessed and reviewed at: https://github.com/lxc/lxd/pull/7598
This e-mail was sent by the LXC bot, direct replies will not reach the author
unless they happen to be subscribed to this list.
=== Description (from pull-request) ===
Signed-off-by: Christian Brauner <christian.brau...@ubuntu.com>
From 53394604dd7a00133f1a80044906ef31429cf05f Mon Sep 17 00:00:00 2001
From: Christian Brauner <christian.brau...@ubuntu.com>
Date: Mon, 29 Jun 2020 15:25:38 +0200
Subject: [PATCH] forksyscall: use nsids for shiftfs syscall intercepts
Signed-off-by: Christian Brauner <christian.brau...@ubuntu.com>
---
lxd/main_forksyscall.go | 13 ++++++---
lxd/seccomp/seccomp.go | 64 ++++++++++++++++++++++++++++++-----------
2 files changed, 56 insertions(+), 21 deletions(-)
diff --git a/lxd/main_forksyscall.go b/lxd/main_forksyscall.go
index 14895b6ce0..f807ef5e6b 100644
--- a/lxd/main_forksyscall.go
+++ b/lxd/main_forksyscall.go
@@ -360,8 +360,8 @@ static void mount_emulate(void)
__do_close int mnt_fd = -EBADF, pidfd = -EBADF, ns_fd = -EBADF;
char *source = NULL, *shiftfs = NULL, *target = NULL, *fstype = NULL;
bool use_fuse;
- uid_t uid = -1, fsuid = -1;
- gid_t gid = -1, fsgid = -1;
+ uid_t nsuid = -1, uid = -1, nsfsuid = -1, fsuid = -1;
+ gid_t nsgid = -1, gid = -1, nsfsgid = -1, fsgid = -1;
int ret;
pid_t pid = -1;
unsigned long flags = 0;
@@ -385,8 +385,13 @@ static void mount_emulate(void)
gid = atoi(advance_arg(true));
fsuid = atoi(advance_arg(true));
fsgid = atoi(advance_arg(true));
- if (!use_fuse)
+ if (!use_fuse) {
+ nsuid = atoi(advance_arg(true));
+ nsgid = atoi(advance_arg(true));
+ nsfsuid = atoi(advance_arg(true));
+ nsfsgid = atoi(advance_arg(true));
data = advance_arg(false);
+ }
mnt_fd = preserve_ns(getpid(), "mnt");
if (mnt_fd < 0)
@@ -465,7 +470,7 @@ static void mount_emulate(void)
_exit(EXIT_FAILURE);
}
- if (!acquire_final_creds(pid, uid, gid, fsuid, fsgid)) {
+ if (!acquire_final_creds(pid, nsuid, nsgid, nsfsuid, nsfsgid)) {
umount2(target, MNT_DETACH);
umount2(target, MNT_DETACH);
_exit(EXIT_FAILURE);
diff --git a/lxd/seccomp/seccomp.go b/lxd/seccomp/seccomp.go
index 025efb3141..d72c97f45b 100644
--- a/lxd/seccomp/seccomp.go
+++ b/lxd/seccomp/seccomp.go
@@ -1222,13 +1222,21 @@ func (s *Server) HandleSetxattrSyscall(c Instance, siov
*Iovec) int {
// MountArgs arguments for mount.
type MountArgs struct {
- source string
- target string
- fstype string
- flags int
- data string
- pid int
- shift bool
+ source string
+ target string
+ fstype string
+ flags int
+ data string
+ pid int
+ shift bool
+ uid int64
+ gid int64
+ fsuid int64
+ fsgid int64
+ nsuid int64
+ nsgid int64
+ nsfsuid int64
+ nsfsgid int64
}
const knownFlags C.ulong = C.MS_BIND | C.MS_LAZYTIME | C.MS_MANDLOCK |
@@ -1445,14 +1453,32 @@ func (s *Server) HandleMountSyscall(c Instance, siov
*Iovec) int {
return 0
}
- nsuid, nsgid, nsfsuid, nsfsgid, err := TaskIDs(args.pid)
+ idmapset, err := c.CurrentIdmap()
if err != nil {
ctx["syscall_continue"] = "true"
C.seccomp_notify_update_response(siov.resp, 0,
C.uint32_t(seccompUserNotifFlagContinue))
return 0
}
- err = s.mountHandleHugetlbfsArgs(c, &args, nsuid, nsgid)
+ args.uid, args.gid, args.fsuid, args.fsgid, err = TaskIDs(args.pid)
+ if err != nil {
+ ctx["syscall_continue"] = "true"
+ C.seccomp_notify_update_response(siov.resp, 0,
C.uint32_t(seccompUserNotifFlagContinue))
+ return 0
+ }
+ ctx["host_uid"] = args.uid
+ ctx["host_gid"] = args.gid
+ ctx["host_fsuid"] = args.fsuid
+ ctx["host_fsgid"] = args.fsgid
+
+ args.nsuid, args.nsgid = idmapset.ShiftFromNs(args.uid, args.gid)
+ args.nsfsuid, args.nsfsgid = idmapset.ShiftFromNs(args.fsuid,
args.fsgid)
+ ctx["ns_uid"] = args.nsuid
+ ctx["ns_gid"] = args.nsgid
+ ctx["ns_fsuid"] = args.nsfsuid
+ ctx["ns_fsgid"] = args.nsfsgid
+
+ err = s.mountHandleHugetlbfsArgs(c, &args, args.uid, args.gid)
if err != nil {
ctx["syscall_continue"] = "true"
C.seccomp_notify_update_response(siov.resp, 0,
C.uint32_t(seccompUserNotifFlagContinue))
@@ -1488,10 +1514,10 @@ func (s *Server) HandleMountSyscall(c Instance, siov
*Iovec) int {
fmt.Sprintf("%d", args.pid),
fmt.Sprintf("%d", pidFdNr),
fmt.Sprintf("%d", 1),
- fmt.Sprintf("%d", nsuid),
- fmt.Sprintf("%d", nsgid),
- fmt.Sprintf("%d", nsfsuid),
- fmt.Sprintf("%d", nsfsgid),
+ fmt.Sprintf("%d", args.uid),
+ fmt.Sprintf("%d", args.gid),
+ fmt.Sprintf("%d", args.fsuid),
+ fmt.Sprintf("%d", args.fsgid),
fmt.Sprintf("%s", fuseSource),
fmt.Sprintf("%s", args.target),
fmt.Sprintf("%s", fuseOpts))
@@ -1510,10 +1536,14 @@ func (s *Server) HandleMountSyscall(c Instance, siov
*Iovec) int {
fmt.Sprintf("%s", args.fstype),
fmt.Sprintf("%d", args.flags),
fmt.Sprintf("%t", args.shift),
- fmt.Sprintf("%d", nsuid),
- fmt.Sprintf("%d", nsgid),
- fmt.Sprintf("%d", nsfsuid),
- fmt.Sprintf("%d", nsfsgid),
+ fmt.Sprintf("%d", args.uid),
+ fmt.Sprintf("%d", args.gid),
+ fmt.Sprintf("%d", args.fsuid),
+ fmt.Sprintf("%d", args.fsgid),
+ fmt.Sprintf("%d", args.nsuid),
+ fmt.Sprintf("%d", args.nsgid),
+ fmt.Sprintf("%d", args.nsfsuid),
+ fmt.Sprintf("%d", args.nsfsgid),
fmt.Sprintf("%s", args.data))
}
if err != nil {
_______________________________________________
lxc-devel mailing list
lxc-devel@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
