Skip to content

Commit 97db45e

Browse files
samuelkarpdmcgowan
samuelkarp
authored and
dmcgowan
committed
v2 runtime: reduce permissions for bundle dir
Bundle directory permissions should be 0700 by default. On Linux with user namespaces enabled, the remapped root also needs access to the bundle directory. In this case, the bundle directory is modified to 0710 and group ownership is changed to the remapped root group. Signed-off-by: Samuel Karp <[email protected]> (cherry picked from commit 7d56b24)
1 parent 1a1b383 commit 97db45e

5 files changed

Lines changed: 270 additions & 1 deletion

File tree

‎runtime/v2/bundle.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,10 @@ func NewBundle(ctx context.Context, root, state, id string, spec []byte) (b *Bun
7272
if err := os.MkdirAll(filepath.Dir(b.Path), 0711); err != nil {
7373
return nil, err
7474
}
75-
if err := os.Mkdir(b.Path, 0711); err != nil {
75+
if err := os.Mkdir(b.Path, 0700); err != nil {
76+
return nil, err
77+
}
78+
if err := prepareBundleDirectoryPermissions(b.Path, spec); err != nil {
7679
return nil, err
7780
}
7881
paths = append(paths, b.Path)

‎runtime/v2/bundle_default.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
//go:build !linux
2+
// +build !linux
3+
4+
/*
5+
Copyright The containerd Authors.
6+
7+
Licensed under the Apache License, Version 2.0 (the "License");
8+
you may not use this file except in compliance with the License.
9+
You may obtain a copy of the License at
10+
11+
http://www.apache.org/licenses/LICENSE-2.0
12+
13+
Unless required by applicable law or agreed to in writing, software
14+
distributed under the License is distributed on an "AS IS" BASIS,
15+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
See the License for the specific language governing permissions and
17+
limitations under the License.
18+
*/
19+
20+
package v2
21+
22+
// prepareBundleDirectoryPermissions prepares the permissions of the bundle
23+
// directory according to the needs of the current platform.
24+
func prepareBundleDirectoryPermissions(path string, spec []byte) error { return nil }

‎runtime/v2/bundle_linux.go‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v2
18+
19+
import (
20+
"encoding/json"
21+
"os"
22+
23+
"github.com/opencontainers/runtime-spec/specs-go"
24+
)
25+
26+
// prepareBundleDirectoryPermissions prepares the permissions of the bundle
27+
// directory according to the needs of the current platform.
28+
// On Linux when user namespaces are enabled, the permissions are modified to
29+
// allow the remapped root GID to access the bundle.
30+
func prepareBundleDirectoryPermissions(path string, spec []byte) error {
31+
gid, err := remappedGID(spec)
32+
if err != nil {
33+
return err
34+
}
35+
if gid == 0 {
36+
return nil
37+
}
38+
if err := os.Chown(path, -1, int(gid)); err != nil {
39+
return err
40+
}
41+
return os.Chmod(path, 0710)
42+
}
43+
44+
// ociSpecUserNS is a subset of specs.Spec used to reduce garbage during
45+
// unmarshal.
46+
type ociSpecUserNS struct {
47+
Linux *linuxSpecUserNS
48+
}
49+
50+
// linuxSpecUserNS is a subset of specs.Linux used to reduce garbage during
51+
// unmarshal.
52+
type linuxSpecUserNS struct {
53+
GIDMappings []specs.LinuxIDMapping
54+
}
55+
56+
// remappedGID reads the remapped GID 0 from the OCI spec, if it exists. If
57+
// there is no remapping, remappedGID returns 0. If the spec cannot be parsed,
58+
// remappedGID returns an error.
59+
func remappedGID(spec []byte) (uint32, error) {
60+
var ociSpec ociSpecUserNS
61+
err := json.Unmarshal(spec, &ociSpec)
62+
if err != nil {
63+
return 0, err
64+
}
65+
if ociSpec.Linux == nil || len(ociSpec.Linux.GIDMappings) == 0 {
66+
return 0, nil
67+
}
68+
for _, mapping := range ociSpec.Linux.GIDMappings {
69+
if mapping.ContainerID == 0 {
70+
return mapping.HostID, nil
71+
}
72+
}
73+
return 0, nil
74+
}

‎runtime/v2/bundle_linux_test.go‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v2
18+
19+
import (
20+
"context"
21+
"encoding/json"
22+
"fmt"
23+
"io/ioutil"
24+
"os"
25+
"path/filepath"
26+
"strconv"
27+
"syscall"
28+
"testing"
29+
30+
"github.com/containerd/containerd/namespaces"
31+
"github.com/containerd/containerd/oci"
32+
"github.com/containerd/containerd/pkg/testutil"
33+
"github.com/opencontainers/runtime-spec/specs-go"
34+
"github.com/stretchr/testify/assert"
35+
"github.com/stretchr/testify/require"
36+
)
37+
38+
func TestNewBundle(t *testing.T) {
39+
testutil.RequiresRoot(t)
40+
tests := []struct {
41+
userns bool
42+
}{{
43+
userns: false,
44+
}, {
45+
userns: true,
46+
}}
47+
const usernsGID = 4200
48+
49+
for i, tc := range tests {
50+
t.Run(strconv.Itoa(i), func(t *testing.T) {
51+
dir, err := ioutil.TempDir("", "test-new-bundle")
52+
require.NoError(t, err, "failed to create test directory")
53+
defer os.RemoveAll(dir)
54+
work := filepath.Join(dir, "work")
55+
state := filepath.Join(dir, "state")
56+
id := fmt.Sprintf("new-bundle-%d", i)
57+
spec := oci.Spec{}
58+
if tc.userns {
59+
spec.Linux = &specs.Linux{
60+
GIDMappings: []specs.LinuxIDMapping{{ContainerID: 0, HostID: usernsGID}},
61+
}
62+
}
63+
specBytes, err := json.Marshal(&spec)
64+
require.NoError(t, err, "failed to marshal spec")
65+
66+
ctx := namespaces.WithNamespace(context.TODO(), namespaces.Default)
67+
b, err := NewBundle(ctx, work, state, id, specBytes)
68+
require.NoError(t, err, "NewBundle should succeed")
69+
require.NotNil(t, b, "bundle should not be nil")
70+
71+
fi, err := os.Stat(b.Path)
72+
assert.NoError(t, err, "should be able to stat bundle path")
73+
if tc.userns {
74+
assert.Equal(t, os.ModeDir|0710, fi.Mode(), "bundle path should be a directory with perm 0710")
75+
} else {
76+
assert.Equal(t, os.ModeDir|0700, fi.Mode(), "bundle path should be a directory with perm 0700")
77+
}
78+
stat, ok := fi.Sys().(*syscall.Stat_t)
79+
require.True(t, ok, "should assert to *syscall.Stat_t")
80+
expectedGID := uint32(0)
81+
if tc.userns {
82+
expectedGID = usernsGID
83+
}
84+
assert.Equal(t, expectedGID, stat.Gid, "gid should match")
85+
86+
})
87+
}
88+
}
89+
90+
func TestRemappedGID(t *testing.T) {
91+
tests := []struct {
92+
spec oci.Spec
93+
gid uint32
94+
}{{
95+
// empty spec
96+
spec: oci.Spec{},
97+
gid: 0,
98+
}, {
99+
// empty Linux section
100+
spec: oci.Spec{
101+
Linux: &specs.Linux{},
102+
},
103+
gid: 0,
104+
}, {
105+
// empty ID mappings
106+
spec: oci.Spec{
107+
Linux: &specs.Linux{
108+
GIDMappings: make([]specs.LinuxIDMapping, 0),
109+
},
110+
},
111+
gid: 0,
112+
}, {
113+
// valid ID mapping
114+
spec: oci.Spec{
115+
Linux: &specs.Linux{
116+
GIDMappings: []specs.LinuxIDMapping{{
117+
ContainerID: 0,
118+
HostID: 1000,
119+
}},
120+
},
121+
},
122+
gid: 1000,
123+
}, {
124+
// missing ID mapping
125+
spec: oci.Spec{
126+
Linux: &specs.Linux{
127+
GIDMappings: []specs.LinuxIDMapping{{
128+
ContainerID: 100,
129+
HostID: 1000,
130+
}},
131+
},
132+
},
133+
gid: 0,
134+
}}
135+
136+
for i, tc := range tests {
137+
t.Run(strconv.Itoa(i), func(t *testing.T) {
138+
s, err := json.Marshal(tc.spec)
139+
require.NoError(t, err, "failed to marshal spec")
140+
gid, err := remappedGID(s)
141+
assert.NoError(t, err, "should unmarshal successfully")
142+
assert.Equal(t, tc.gid, gid, "expected GID to match")
143+
})
144+
}
145+
}

‎runtime/v2/bundle_test.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v2
18+
19+
import (
20+
// When testutil is imported for one platform (bundle_linux_test.go) it
21+
// should be imported for all platforms.
22+
_ "github.com/containerd/containerd/pkg/testutil"
23+
)

0 commit comments

Comments
 (0)