public inbox for passt-dev@passt.top
 help / color / mirror / code / Atom feed
From: David Gibson <david@gibson.dropbear.id.au>
To: passt-dev@passt.top
Subject: [PATCH v3 04/10] Safer handling if we can't open /proc/self/uid_map
Date: Mon, 12 Sep 2022 22:24:02 +1000	[thread overview]
Message-ID: <20220912122408.1372372-5-david@gibson.dropbear.id.au> (raw)
In-Reply-To: <20220912122408.1372372-1-david@gibson.dropbear.id.au>

[-- Attachment #1: Type: text/plain, Size: 1483 bytes --]

passt is allowed to run as "root" (UID 0) in a user namespace, but notas
real root in the init namespace.  We read /proc/self/uid_map to determine
if we're in the init namespace or not.

If we're unable to open /proc/self/uid_map we assume we're ok and
continue running as UID 0.  This seems unwise.  The only instances I
can think of where uid_map won't be available are if the host kernel
doesn't support namespaces, or /proc is not mounted.  In neither case
is it safe to assume we're "not really" root and continue (although in
practice we'd likely fail for other reasons pretty soon anyway).

Therefore, fail with an error in this case, instead of carrying on.

Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
 conf.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/conf.c b/conf.c
index a97e055..b669f5d 100644
--- a/conf.c
+++ b/conf.c
@@ -1054,8 +1054,12 @@ static int conf_ugid(const char *runas, uid_t *uid, gid_t *gid)
 		return 0;
 
 	/* ...or at least not root in the init namespace... */
-	if ((fd = open("/proc/self/uid_map", O_RDONLY | O_CLOEXEC)) < 0)
-		return 0;
+	if ((fd = open("/proc/self/uid_map", O_RDONLY | O_CLOEXEC)) < 0) {
+		ret = -errno;
+		err("Can't determine if we're in init namespace: %s",
+		    strerror(-ret));
+		return ret;
+	}
 
 	if (read(fd, buf, BUFSIZ) != sizeof(root_uid_map) ||
 	    strncmp(buf, root_uid_map, sizeof(root_uid_map) - 1)) {
-- 
@@ -1054,8 +1054,12 @@ static int conf_ugid(const char *runas, uid_t *uid, gid_t *gid)
 		return 0;
 
 	/* ...or at least not root in the init namespace... */
-	if ((fd = open("/proc/self/uid_map", O_RDONLY | O_CLOEXEC)) < 0)
-		return 0;
+	if ((fd = open("/proc/self/uid_map", O_RDONLY | O_CLOEXEC)) < 0) {
+		ret = -errno;
+		err("Can't determine if we're in init namespace: %s",
+		    strerror(-ret));
+		return ret;
+	}
 
 	if (read(fd, buf, BUFSIZ) != sizeof(root_uid_map) ||
 	    strncmp(buf, root_uid_map, sizeof(root_uid_map) - 1)) {
-- 
2.37.3


  parent reply	other threads:[~2022-09-12 12:24 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-09-12 12:23 [PATCH v3 00/10] Clean up handling of userns David Gibson
2022-09-12 12:23 ` [PATCH v3 01/10] Don't store UID & GID persistently in the context structure David Gibson
2022-09-12 12:24 ` [PATCH v3 02/10] Split checking for root from dropping root privilege David Gibson
2022-09-12 12:24 ` [PATCH v3 03/10] Consolidate determination of UID/GID to run as David Gibson
2022-09-12 12:24 ` David Gibson [this message]
2022-09-12 12:24 ` [PATCH v3 05/10] Move self-isolation code into a separate file David Gibson
2022-09-12 12:24 ` [PATCH v3 06/10] Consolidate validation of pasta namespace options David Gibson
2022-09-12 12:24 ` [PATCH v3 07/10] Clean up and rename conf_ns_open() David Gibson
2022-09-12 12:24 ` [PATCH v3 08/10] Correctly handle --netns-only in pasta_start_ns() David Gibson
2022-09-12 12:24 ` [PATCH v3 09/10] Handle userns isolation and dropping root at the same time David Gibson
2022-09-12 12:24 ` [PATCH v3 10/10] Allow --userns when pasta spawns a command David Gibson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220912122408.1372372-5-david@gibson.dropbear.id.au \
    --to=david@gibson.dropbear.id.au \
    --cc=passt-dev@passt.top \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://passt.top/passt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).