Skip to content

Commit 1912d59

Browse files
cypharcyphar
committed
*: actually support joining a userns with a new container
Our handling for name space paths with user namespaces has been broken for a long time. In particular, the need to parse /proc/self/*id_map in quite a few places meant that we would treat userns configurations that had a namespace path as if they were a userns configuration without mappings, resulting in errors. The primary issue was down to the id translation helper functions, which could only handle configurations that had explicit mappings. Obviously, when joining a user namespace we need to map the ids but figuring out the correct mapping is non-trivial in comparison. In order to get the mapping, you need to read /proc/<pid>/*id_map of a process inside the userns -- while most userns paths will be of the form /proc/<pid>/ns/user (and we have a fast-path for this case), this is not guaranteed and thus it is necessary to spawn a process inside the container and read its /proc/<pid>/*id_map files in the general case. As Go does not allow us spawn a subprocess into a target userns, we have to use CGo to fork a sub-process which does the setns(2). To be honest, this is a little dodgy in regards to POSIX signal-safety(7) but since we do no allocations and we are executing in the forked context from a Go program (not a C program), it should be okay. The other alternative would be to do an expensive re-exec (a-la nsexec which would make several other bits of runc more complicated), or to use nsenter(1) which might not exist on the system and is less than ideal. Because we need to logically remap users quite a few times in runc (including in "runc init", where joining the namespace is not feasable), we cache the mapping inside the libcontainer config struct. A future patch will make sure that we stop allow invalid user configurations where a mapping is specified as well as a userns path to join. Finally, add an integration test to make sure we don't regress this again. Signed-off-by: Aleksa Sarai <[email protected]>
1 parent 8841174 commit 1912d59

5 files changed

Lines changed: 361 additions & 20 deletions

File tree

‎libcontainer/configs/validate/rootless.go‎

Lines changed: 13 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package validate
22

33
import (
44
"errors"
5+
"fmt"
56
"strconv"
67
"strings"
78

@@ -28,25 +29,18 @@ func rootlessEUIDCheck(config *configs.Config) error {
2829
return nil
2930
}
3031

31-
func hasIDMapping(id int, mappings []configs.IDMap) bool {
32-
for _, m := range mappings {
33-
if id >= m.ContainerID && id < m.ContainerID+m.Size {
34-
return true
35-
}
36-
}
37-
return false
38-
}
39-
4032
func rootlessEUIDMappings(config *configs.Config) error {
4133
if !config.Namespaces.Contains(configs.NEWUSER) {
4234
return errors.New("rootless container requires user namespaces")
4335
}
44-
45-
if len(config.UIDMappings) == 0 {
46-
return errors.New("rootless containers requires at least one UID mapping")
47-
}
48-
if len(config.GIDMappings) == 0 {
49-
return errors.New("rootless containers requires at least one GID mapping")
36+
// We only require mappings if we are not joining another userns.
37+
if path := config.Namespaces.PathOf(configs.NEWUSER); path == "" {
38+
if len(config.UIDMappings) == 0 {
39+
return errors.New("rootless containers requires at least one UID mapping")
40+
}
41+
if len(config.GIDMappings) == 0 {
42+
return errors.New("rootless containers requires at least one GID mapping")
43+
}
5044
}
5145
return nil
5246
}
@@ -68,8 +62,8 @@ func rootlessEUIDMount(config *configs.Config) error {
6862
// Ignore unknown mount options.
6963
continue
7064
}
71-
if !hasIDMapping(uid, config.UIDMappings) {
72-
return errors.New("cannot specify uid= mount options for unmapped uid in rootless containers")
65+
if _, err := config.HostUID(uid); err != nil {
66+
return fmt.Errorf("cannot specify uid=%d mount option for rootless container: %w", uid, err)
7367
}
7468
}
7569

@@ -79,8 +73,8 @@ func rootlessEUIDMount(config *configs.Config) error {
7973
// Ignore unknown mount options.
8074
continue
8175
}
82-
if !hasIDMapping(gid, config.GIDMappings) {
83-
return errors.New("cannot specify gid= mount options for unmapped gid in rootless containers")
76+
if _, err := config.HostGID(gid); err != nil {
77+
return fmt.Errorf("cannot specify gid=%d mount option for rootless container: %w", gid, err)
8478
}
8579
}
8680
}

‎libcontainer/specconv/spec_linux.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"github.com/opencontainers/runc/libcontainer/configs"
1919
"github.com/opencontainers/runc/libcontainer/devices"
2020
"github.com/opencontainers/runc/libcontainer/seccomp"
21+
"github.com/opencontainers/runc/libcontainer/userns"
2122
libcontainerUtils "github.com/opencontainers/runc/libcontainer/utils"
2223
"github.com/opencontainers/runtime-spec/specs-go"
2324
"github.com/sirupsen/logrus"
@@ -968,6 +969,21 @@ func setupUserNamespace(spec *specs.Spec, config *configs.Config) error {
968969
config.UIDMappings = toConfigIDMap(spec.Linux.UIDMappings)
969970
config.GIDMappings = toConfigIDMap(spec.Linux.GIDMappings)
970971
}
972+
if path := config.Namespaces.PathOf(configs.NEWUSER); path != "" {
973+
// Cache the current userns mappings in our configuration, so that we
974+
// can calculate uid and gid mappings within runc. These mappings are
975+
// never used for configuring the container if the path is set.
976+
uidMap, gidMap, err := userns.GetUserNamespaceMappings(path)
977+
if err != nil {
978+
return fmt.Errorf("failed to cache mappings for userns: %w", err)
979+
}
980+
config.UIDMappings = uidMap
981+
config.GIDMappings = gidMap
982+
logrus.WithFields(logrus.Fields{
983+
"uid_map": uidMap,
984+
"gid_map": gidMap,
985+
}).Debugf("config uses path-based userns configuration -- current uid and gid mappings cached")
986+
}
971987
rootUID, err := config.HostRootUID()
972988
if err != nil {
973989
return err

‎libcontainer/userns/userns_maps.c‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#define _GNU_SOURCE
2+
#include <fcntl.h>
3+
#include <sched.h>
4+
#include <stdio.h>
5+
#include <unistd.h>
6+
#include <stdarg.h>
7+
#include <stdlib.h>
8+
9+
/*
10+
* All of the code here is run inside an aync-signal-safe context, so we need
11+
* to be careful to not call any functions that could cause issues. In theory,
12+
* since we are a Go program, there are fewer restrictions in practice, it's
13+
* better to be safe than sorry.
14+
*
15+
* The only exception is exit, which we need to call to make sure we don't
16+
* return into runc.
17+
*/
18+
19+
void bail(int pipefd, const char *fmt, ...)
20+
{
21+
va_list args;
22+
23+
va_start(args, fmt);
24+
vdprintf(pipefd, fmt, args);
25+
va_end(args);
26+
27+
exit(1);
28+
}
29+
30+
int spawn_userns_cat(char *userns_path, char *path, int outfd, int errfd)
31+
{
32+
char buffer[4096] = { 0 };
33+
34+
pid_t child = fork();
35+
if (child != 0)
36+
return child;
37+
/* in child */
38+
39+
/* Join the target userns. */
40+
int nsfd = open(userns_path, O_RDONLY);
41+
if (nsfd < 0)
42+
bail(errfd, "open userns path %s failed: %m", userns_path);
43+
44+
int err = setns(nsfd, CLONE_NEWUSER);
45+
if (err < 0)
46+
bail(errfd, "setns %s failed: %m", userns_path);
47+
48+
close(nsfd);
49+
50+
/* Pipe the requested file contents. */
51+
int fd = open(path, O_RDONLY);
52+
if (fd < 0)
53+
bail(errfd, "open %s in userns %s failed: %m", path, userns_path);
54+
55+
int nread, ntotal = 0;
56+
while ((nread = read(fd, buffer, sizeof(buffer))) != 0) {
57+
if (nread < 0)
58+
bail(errfd, "read bytes from %s failed (after %d total bytes read): %m", path, ntotal);
59+
ntotal += nread;
60+
61+
int nwritten = 0;
62+
while (nwritten < nread) {
63+
int n = write(outfd, buffer, nread - nwritten);
64+
if (n < 0)
65+
bail(errfd, "write %d bytes from %s failed (after %d bytes written): %m",
66+
nread - nwritten, path, nwritten);
67+
nwritten += n;
68+
}
69+
if (nread != nwritten)
70+
bail(errfd, "mismatch for bytes read and written: %d read != %d written", nread, nwritten);
71+
}
72+
73+
close(fd);
74+
close(outfd);
75+
close(errfd);
76+
77+
/* We must exit here, otherwise we would return into a forked runc. */
78+
exit(0);
79+
}

‎libcontainer/userns/userns_maps_linux.go‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
//go:build linux
2+
3+
package userns
4+
5+
import (
6+
"bufio"
7+
"bytes"
8+
"fmt"
9+
"io"
10+
"os"
11+
"unsafe"
12+
13+
"github.com/opencontainers/runc/libcontainer/configs"
14+
"github.com/sirupsen/logrus"
15+
)
16+
17+
/*
18+
#include <stdlib.h>
19+
extern int spawn_userns_cat(char *userns_path, char *path, int outfd, int errfd);
20+
*/
21+
import "C"
22+
23+
func parseIdmapData(data []byte) (ms []configs.IDMap, err error) {
24+
scanner := bufio.NewScanner(bytes.NewReader(data))
25+
for scanner.Scan() {
26+
var m configs.IDMap
27+
line := scanner.Text()
28+
if _, err := fmt.Sscanf(line, "%d %d %d", &m.ContainerID, &m.HostID, &m.Size); err != nil {
29+
return nil, fmt.Errorf("parsing id map failed: invalid format in line %q: %w", line, err)
30+
}
31+
ms = append(ms, m)
32+
}
33+
if err := scanner.Err(); err != nil {
34+
return nil, fmt.Errorf("parsing id map failed: %w", err)
35+
}
36+
return ms, nil
37+
}
38+
39+
// Do something equivalent to nsenter --user=<nsPath> cat <path>, but more
40+
// efficiently. Returns the contents of the requested file from within the user
41+
// namespace.
42+
func spawnUserNamespaceCat(nsPath string, path string) ([]byte, error) {
43+
rdr, wtr, err := os.Pipe()
44+
if err != nil {
45+
return nil, fmt.Errorf("create pipe for userns spawn failed: %w", err)
46+
}
47+
defer rdr.Close()
48+
defer wtr.Close()
49+
50+
errRdr, errWtr, err := os.Pipe()
51+
if err != nil {
52+
return nil, fmt.Errorf("create error pipe for userns spawn failed: %w", err)
53+
}
54+
defer errRdr.Close()
55+
defer errWtr.Close()
56+
57+
cNsPath := C.CString(nsPath)
58+
defer C.free(unsafe.Pointer(cNsPath))
59+
cPath := C.CString(path)
60+
defer C.free(unsafe.Pointer(cPath))
61+
62+
childPid := C.spawn_userns_cat(cNsPath, cPath, C.int(wtr.Fd()), C.int(errWtr.Fd()))
63+
64+
if childPid < 0 {
65+
return nil, fmt.Errorf("failed to spawn fork for userns")
66+
} else if childPid == 0 {
67+
// this should never happen
68+
panic("runc executing inside fork child -- unsafe state!")
69+
}
70+
71+
// We are in the parent -- close the write end of the pipe before reading.
72+
wtr.Close()
73+
output, err := io.ReadAll(rdr)
74+
rdr.Close()
75+
if err != nil {
76+
return nil, fmt.Errorf("reading from userns spawn failed: %w", err)
77+
}
78+
79+
// Ditto for the error pipe.
80+
errWtr.Close()
81+
errOutput, err := io.ReadAll(errRdr)
82+
errRdr.Close()
83+
if err != nil {
84+
return nil, fmt.Errorf("reading from userns spawn error pipe failed: %w", err)
85+
}
86+
errOutput = bytes.TrimSpace(errOutput)
87+
88+
// Clean up the child.
89+
child, err := os.FindProcess(int(childPid))
90+
if err != nil {
91+
return nil, fmt.Errorf("could not find userns spawn process: %w", err)
92+
}
93+
state, err := child.Wait()
94+
if err != nil {
95+
return nil, fmt.Errorf("failed to wait for userns spawn process: %w", err)
96+
}
97+
if !state.Success() {
98+
errStr := string(errOutput)
99+
if errStr == "" {
100+
errStr = fmt.Sprintf("unknown error (status code %d)", state.ExitCode())
101+
}
102+
return nil, fmt.Errorf("userns spawn: %s", errStr)
103+
} else if len(errOutput) > 0 {
104+
// We can just ignore weird output in the error pipe if the process
105+
// didn't bail(), but for completeness output for debugging.
106+
logrus.Debugf("userns spawn succeeded but unexpected error message found: %s", string(errOutput))
107+
}
108+
// The subprocess succeeded, return whatever it wrote to the pipe.
109+
return output, nil
110+
}
111+
112+
func GetUserNamespaceMappings(nsPath string) (uidMap, gidMap []configs.IDMap, err error) {
113+
var (
114+
pid int
115+
extra rune
116+
tryFastPath bool
117+
)
118+
119+
// nsPath is usually of the form /proc/<pid>/ns/user, which means that we
120+
// already have a pid that is part of the user namespace and thus we can
121+
// just use the pid to read from /proc/<pid>/*id_map.
122+
//
123+
// Note that Sscanf doesn't consume the whole input, so we check for any
124+
// trailing data with %c. That way, we can be sure the pattern matched
125+
// /proc/$pid/ns/user _exactly_ iff n === 1.
126+
if n, _ := fmt.Sscanf(nsPath, "/proc/%d/ns/user%c", &pid, &extra); n == 1 {
127+
tryFastPath = pid > 0
128+
}
129+
130+
for _, mapType := range []struct {
131+
name string
132+
idMap *[]configs.IDMap
133+
}{
134+
{"uid_map", &uidMap},
135+
{"gid_map", &gidMap},
136+
} {
137+
var mapData []byte
138+
139+
if tryFastPath {
140+
path := fmt.Sprintf("/proc/%d/%s", pid, mapType.name)
141+
data, err := os.ReadFile(path)
142+
if err != nil {
143+
// Do not error out here -- we need to try the slow path if the
144+
// fast path failed.
145+
logrus.Debugf("failed to use fast path to read %s from userns %s (error: %s), falling back to slow userns-join path", mapType.name, nsPath, err)
146+
} else {
147+
mapData = data
148+
}
149+
} else {
150+
logrus.Debugf("cannot use fast path to read %s from userns %s, falling back to slow userns-join path", mapType.name, nsPath)
151+
}
152+
153+
if mapData == nil {
154+
// We have to actually join the namespace if we cannot take the
155+
// fast path. The path is resolved with respect to the child
156+
// process, so just use /proc/self.
157+
data, err := spawnUserNamespaceCat(nsPath, "/proc/self/"+mapType.name)
158+
if err != nil {
159+
return nil, nil, err
160+
}
161+
mapData = data
162+
}
163+
idMap, err := parseIdmapData(mapData)
164+
if err != nil {
165+
return nil, nil, fmt.Errorf("failed to parse %s of userns %s: %w", mapType.name, nsPath, err)
166+
}
167+
*mapType.idMap = idMap
168+
}
169+
170+
return uidMap, gidMap, nil
171+
}

0 commit comments

Comments
 (0)