Skip to content

Commit 6886c6a

Browse files
samuelkarpsamuelkarp
committed
v1 runtime: reduce permissions for bundle dir
Bundle directory permissions should be 0700 by default. On Linux with user namespaces enabled, the remapped root also needs access to the bundle directory. In this case, the bundle directory is modified to 0710 and group ownership is changed to the remapped root group. Port of the same change for the v2 runtime Signed-off-by: Samuel Karp <[email protected]>
1 parent 7d56b24 commit 6886c6a

2 files changed

Lines changed: 200 additions & 1 deletion

File tree

‎runtime/v1/linux/bundle.go‎

Lines changed: 55 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ package linux
2222
import (
2323
"context"
2424
"crypto/sha256"
25+
"encoding/json"
2526
"fmt"
2627
"io/ioutil"
2728
"os"
@@ -31,6 +32,7 @@ import (
3132
"github.com/containerd/containerd/runtime/linux/runctypes"
3233
"github.com/containerd/containerd/runtime/v1/shim"
3334
"github.com/containerd/containerd/runtime/v1/shim/client"
35+
"github.com/opencontainers/runtime-spec/specs-go"
3436
"github.com/pkg/errors"
3537
)
3638

@@ -49,14 +51,17 @@ func newBundle(id, path, workDir string, spec []byte) (b *bundle, err error) {
4951
return nil, err
5052
}
5153
path = filepath.Join(path, id)
52-
if err := os.Mkdir(path, 0711); err != nil {
54+
if err := os.Mkdir(path, 0700); err != nil {
5355
return nil, err
5456
}
5557
defer func() {
5658
if err != nil {
5759
os.RemoveAll(path)
5860
}
5961
}()
62+
if err := prepareBundleDirectoryPermissions(path, spec); err != nil {
63+
return nil, err
64+
}
6065
workDir = filepath.Join(workDir, id)
6166
if err := os.MkdirAll(workDir, 0711); err != nil {
6267
return nil, err
@@ -78,6 +83,55 @@ func newBundle(id, path, workDir string, spec []byte) (b *bundle, err error) {
7883
}, err
7984
}
8085

86+
// prepareBundleDirectoryPermissions prepares the permissions of the bundle
87+
// directory. When user namespaces are enabled, the permissions are modified
88+
// to allow the remapped root GID to access the bundle.
89+
func prepareBundleDirectoryPermissions(path string, spec []byte) error {
90+
gid, err := remappedGID(spec)
91+
if err != nil {
92+
return err
93+
}
94+
if gid == 0 {
95+
return nil
96+
}
97+
if err := os.Chown(path, -1, int(gid)); err != nil {
98+
return err
99+
}
100+
return os.Chmod(path, 0710)
101+
}
102+
103+
// ociSpecUserNS is a subset of specs.Spec used to reduce garbage during
104+
// unmarshal.
105+
type ociSpecUserNS struct {
106+
Linux *linuxSpecUserNS
107+
}
108+
109+
// linuxSpecUserNS is a subset of specs.Linux used to reduce garbage during
110+
// unmarshal.
111+
type linuxSpecUserNS struct {
112+
GIDMappings []specs.LinuxIDMapping
113+
}
114+
115+
// remappedGID reads the remapped GID 0 from the OCI spec, if it exists. If
116+
// there is no remapping, remappedGID returns 0. If the spec cannot be parsed,
117+
// remappedGID returns an error.
118+
func remappedGID(spec []byte) (uint32, error) {
119+
var ociSpec ociSpecUserNS
120+
err := json.Unmarshal(spec, &ociSpec)
121+
if err != nil {
122+
return 0, err
123+
}
124+
if ociSpec.Linux == nil || len(ociSpec.Linux.GIDMappings) == 0 {
125+
return 0, nil
126+
}
127+
for _, mapping := range ociSpec.Linux.GIDMappings {
128+
if mapping.ContainerID == 0 {
129+
return mapping.HostID, nil
130+
}
131+
}
132+
return 0, nil
133+
}
134+
81135
type bundle struct {
82136
id string
83137
path string

‎runtime/v1/linux/bundle_test.go‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
//go:build linux
2+
// +build linux
3+
4+
/*
5+
Copyright The containerd Authors.
6+
7+
Licensed under the Apache License, Version 2.0 (the "License");
8+
you may not use this file except in compliance with the License.
9+
You may obtain a copy of the License at
10+
11+
http://www.apache.org/licenses/LICENSE-2.0
12+
13+
Unless required by applicable law or agreed to in writing, software
14+
distributed under the License is distributed on an "AS IS" BASIS,
15+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
See the License for the specific language governing permissions and
17+
limitations under the License.
18+
*/
19+
20+
package linux
21+
22+
import (
23+
"encoding/json"
24+
"fmt"
25+
"io/ioutil"
26+
"os"
27+
"path/filepath"
28+
"strconv"
29+
"syscall"
30+
"testing"
31+
32+
"github.com/containerd/containerd/oci"
33+
"github.com/containerd/continuity/testutil"
34+
"github.com/opencontainers/runtime-spec/specs-go"
35+
"github.com/stretchr/testify/assert"
36+
"github.com/stretchr/testify/require"
37+
)
38+
39+
func TestNewBundle(t *testing.T) {
40+
testutil.RequiresRoot(t)
41+
tests := []struct {
42+
userns bool
43+
}{{
44+
userns: false,
45+
}, {
46+
userns: true,
47+
}}
48+
const usernsGID = 4200
49+
50+
for i, tc := range tests {
51+
t.Run(strconv.Itoa(i), func(t *testing.T) {
52+
dir, err := ioutil.TempDir("", "test-new-bundle")
53+
require.NoError(t, err, "failed to create test directory")
54+
defer os.RemoveAll(dir)
55+
work := filepath.Join(dir, "work")
56+
state := filepath.Join(dir, "state")
57+
id := fmt.Sprintf("new-bundle-%d", i)
58+
spec := oci.Spec{}
59+
if tc.userns {
60+
spec.Linux = &specs.Linux{
61+
GIDMappings: []specs.LinuxIDMapping{{ContainerID: 0, HostID: usernsGID}},
62+
}
63+
}
64+
specBytes, err := json.Marshal(&spec)
65+
require.NoError(t, err, "failed to marshal spec")
66+
67+
b, err := newBundle(id, work, state, specBytes)
68+
require.NoError(t, err, "newBundle should succeed")
69+
require.NotNil(t, b, "bundle should not be nil")
70+
71+
fi, err := os.Stat(b.path)
72+
assert.NoError(t, err, "should be able to stat bundle path")
73+
if tc.userns {
74+
assert.Equal(t, os.ModeDir|0710, fi.Mode(), "bundle path should be a directory with perm 0710")
75+
} else {
76+
assert.Equal(t, os.ModeDir|0700, fi.Mode(), "bundle path should be a directory with perm 0700")
77+
}
78+
stat, ok := fi.Sys().(*syscall.Stat_t)
79+
require.True(t, ok, "should assert to *syscall.Stat_t")
80+
expectedGID := uint32(0)
81+
if tc.userns {
82+
expectedGID = usernsGID
83+
}
84+
assert.Equal(t, expectedGID, stat.Gid, "gid should match")
85+
86+
})
87+
}
88+
}
89+
90+
func TestRemappedGID(t *testing.T) {
91+
tests := []struct {
92+
spec oci.Spec
93+
gid uint32
94+
}{{
95+
// empty spec
96+
spec: oci.Spec{},
97+
gid: 0,
98+
}, {
99+
// empty Linux section
100+
spec: oci.Spec{
101+
Linux: &specs.Linux{},
102+
},
103+
gid: 0,
104+
}, {
105+
// empty ID mappings
106+
spec: oci.Spec{
107+
Linux: &specs.Linux{
108+
GIDMappings: make([]specs.LinuxIDMapping, 0),
109+
},
110+
},
111+
gid: 0,
112+
}, {
113+
// valid ID mapping
114+
spec: oci.Spec{
115+
Linux: &specs.Linux{
116+
GIDMappings: []specs.LinuxIDMapping{{
117+
ContainerID: 0,
118+
HostID: 1000,
119+
}},
120+
},
121+
},
122+
gid: 1000,
123+
}, {
124+
// missing ID mapping
125+
spec: oci.Spec{
126+
Linux: &specs.Linux{
127+
GIDMappings: []specs.LinuxIDMapping{{
128+
ContainerID: 100,
129+
HostID: 1000,
130+
}},
131+
},
132+
},
133+
gid: 0,
134+
}}
135+
136+
for i, tc := range tests {
137+
t.Run(strconv.Itoa(i), func(t *testing.T) {
138+
s, err := json.Marshal(tc.spec)
139+
require.NoError(t, err, "failed to marshal spec")
140+
gid, err := remappedGID(s)
141+
assert.NoError(t, err, "should unmarshal successfully")
142+
assert.Equal(t, tc.gid, gid, "expected GID to match")
143+
})
144+
}
145+
}

0 commit comments

Comments
 (0)