From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=dbb.dev Authentication-Results: passt.top; dkim=pass (1024-bit key; secure) header.d=dbb.dev header.i=@dbb.dev header.a=rsa-sha256 header.s=jul08 header.b=UpX7yMsa; dkim-atps=neutral Received: from taz.dbb.computer (taz.dbb.computer [IPv6:2001:19f0:1000:1e08:5400:4ff:fe5d:8516]) by passt.top (Postfix) with ESMTPS id 64B9D5A0271 for ; Tue, 21 Jul 2026 17:37:33 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dbb.dev; s=jul08; t=1784648252; bh=mxOgLgmHeVYM3RUUNvxRKl5zQ60dMdDzkVk46KaNlbE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=UpX7yMsaMBQClo/a+RmFzIXxyRbC8Q5A9UUZVL5UUOYV2MycXKs02Bpr4tocc7RjL Wls88bM/fI4sBCNrGNxd+a0hmBtLxOmk5vT6Yr5zjVlUiaqQDNB31J6sPjCoRvNJK2 3aYKr7jacE7pJX9+smsfZZBSZnGM+orPZLbq5/38= Authentication-Results: taz.dbb.computer; dmarc=pass (p=quarantine dis=none) header.from=dbb.dev Authentication-Results: taz.dbb.computer; spf=pass smtp.mailfrom=dbb.dev Received: from taz.dbb.computer (localhost [IPv6:::1]) by taz.dbb.computer (Postfix) with ESMTP id 6155A29C8B8; Tue, 21 Jul 2026 15:37:32 +0000 (UTC) Received: from localhost ([69.119.138.76]) by taz.dbb.computer with ESMTPSA id A7zDFjySX2prdQwArUmV4g (envelope-from ); Tue, 21 Jul 2026 15:37:32 +0000 From: "Dwayne B. Bent" To: passt-dev@passt.top Subject: [PATCH 2/2] pasta: Do not configure ID mappings when invoked with --netns-only Date: Tue, 21 Jul 2026 11:37:27 -0400 Message-ID: <20260721153727.2173831-3-dbb@dbb.dev> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721153727.2173831-1-dbb@dbb.dev> References: <20260721153727.2173831-1-dbb@dbb.dev> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: HHAGHBEWNRK3NPZIPWXV72VZEFNPWSB6 X-Message-ID-Hash: HHAGHBEWNRK3NPZIPWXV72VZEFNPWSB6 X-MailFrom: dbb@dbb.dev X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: "Dwayne B. Bent" X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Add a `bool` argument `config_idmaps` to `pasta_start_ns()` that guards the logic to configure user and group ID mappings. It is set to `false` when `netns_only` is `true`. Fixes bug 216. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Dwayne B. Bent --- conf.c | 2 +- pasta.c | 24 ++++++++++++++---------- pasta.h | 3 ++- 3 files changed, 17 insertions(+), 12 deletions(-) diff --git a/conf.c b/conf.c index 0fcba5c..2223604 100644 --- a/conf.c +++ b/conf.c @@ -1945,7 +1945,7 @@ void conf(struct ctx *c, int argc, char **argv) if (*netns) { pasta_open_ns(c, netns); } else { - pasta_start_ns(c, uid, gid, + pasta_start_ns(c, uid, gid, !netns_only, argc - optind, argv + optind); } } diff --git a/pasta.c b/pasta.c index 4e7ee54..5aa56b7 100644 --- a/pasta.c +++ b/pasta.c @@ -236,10 +236,11 @@ static int pasta_spawn_cmd(void *arg) * @c: Execution context * @uid: UID we're running as in the init namespace * @gid: GID we're running as in the init namespace + * @config_idmaps: Whether to configure user mappings * @argc: Number of arguments for spawned command * @argv: Command to spawn and arguments */ -void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, +void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]) { char ns_fn_stack[NS_FN_STACK_SIZE] @@ -249,7 +250,6 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, .argv = argv, .c = c, }; - char uidmap[BUFSIZ], gidmap[BUFSIZ]; char *sh_argv[] = { NULL, NULL }; char sh_arg0[PATH_MAX + 1]; sigset_t set; @@ -259,16 +259,20 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, c->quiet = 1; /* Configure user and group mappings */ - if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid)) - die_perror("Can't build uidmap"); + if (config_idmaps) { + char uidmap[BUFSIZ], gidmap[BUFSIZ]; - if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid)) - die_perror("Can't build gidmap"); + if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid)) + die_perror("Can't build uidmap"); - if (write_file("/proc/self/uid_map", uidmap) || - write_file("/proc/self/setgroups", "deny") || - write_file("/proc/self/gid_map", gidmap)) { - warn("Couldn't configure user mappings"); + if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid)) + die_perror("Can't build gidmap"); + + if (write_file("/proc/self/uid_map", uidmap) || + write_file("/proc/self/setgroups", "deny") || + write_file("/proc/self/gid_map", gidmap)) { + warn("Couldn't configure user mappings"); + } } if (argc == 0) { diff --git a/pasta.h b/pasta.h index 07e04b3..edd7747 100644 --- a/pasta.h +++ b/pasta.h @@ -6,12 +6,13 @@ #ifndef PASTA_H #define PASTA_H +#include #include extern int pasta_child_pid; void pasta_open_ns(struct ctx *c, const char *netns); -void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, +void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]); void pasta_ns_conf(struct ctx *c); void pasta_child_handler(int signal); -- 2.55.0