Re: [PATCH 2/2] pasta: Do not configure ID mappings when invoked with --netns-only

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 3806 bytes --]

On Tue, Jul 21, 2026 at 11:37:27AM -0400, Dwayne B. Bent wrote:
> Add a `bool` argument `config_idmaps` to `pasta_start_ns()` that guards
> the logic to configure user and group ID mappings. It is set to `false`
> when `netns_only` is `true`. Fixes bug 216.
> 
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Dwayne B. Bent <dbb@dbb.dev>

Needs a
	Link: https://bugs.passt.top/show_bug.cgi?id=216
line.  Otherwise looks fine to me.

> ---
>  conf.c  |  2 +-
>  pasta.c | 24 ++++++++++++++----------
>  pasta.h |  3 ++-
>  3 files changed, 17 insertions(+), 12 deletions(-)
> 
> diff --git a/conf.c b/conf.c
> index 0fcba5c..2223604 100644
> --- a/conf.c
> +++ b/conf.c
> @@ -1945,7 +1945,7 @@ void conf(struct ctx *c, int argc, char **argv)
>  		if (*netns) {
>  			pasta_open_ns(c, netns);
>  		} else {
> -			pasta_start_ns(c, uid, gid,
> +			pasta_start_ns(c, uid, gid, !netns_only,
>  				       argc - optind, argv + optind);
>  		}
>  	}
> diff --git a/pasta.c b/pasta.c
> index 4e7ee54..5aa56b7 100644
> --- a/pasta.c
> +++ b/pasta.c
> @@ -236,10 +236,11 @@ static int pasta_spawn_cmd(void *arg)
>   * @c:		Execution context
>   * @uid:	UID we're running as in the init namespace
>   * @gid:	GID we're running as in the init namespace
> + * @config_idmaps:	Whether to configure user mappings
>   * @argc:	Number of arguments for spawned command
>   * @argv:	Command to spawn and arguments
>   */
> -void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
> +void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps,
>  		    int argc, char *argv[])
>  {
>  	char ns_fn_stack[NS_FN_STACK_SIZE]
> @@ -249,7 +250,6 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
>  		.argv = argv,
>  		.c = c,
>  	};
> -	char uidmap[BUFSIZ], gidmap[BUFSIZ];
>  	char *sh_argv[] = { NULL, NULL };
>  	char sh_arg0[PATH_MAX + 1];
>  	sigset_t set;
> @@ -259,16 +259,20 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
>  		c->quiet = 1;
>  
>  	/* Configure user and group mappings */
> -	if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid))
> -		die_perror("Can't build uidmap");
> +	if (config_idmaps) {
> +		char uidmap[BUFSIZ], gidmap[BUFSIZ];
>  
> -	if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid))
> -		die_perror("Can't build gidmap");
> +		if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid))
> +			die_perror("Can't build uidmap");
>  
> -	if (write_file("/proc/self/uid_map", uidmap) ||
> -	    write_file("/proc/self/setgroups", "deny") ||
> -	    write_file("/proc/self/gid_map", gidmap)) {
> -		warn("Couldn't configure user mappings");
> +		if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid))
> +			die_perror("Can't build gidmap");
> +
> +		if (write_file("/proc/self/uid_map", uidmap) ||
> +		    write_file("/proc/self/setgroups", "deny") ||
> +		    write_file("/proc/self/gid_map", gidmap)) {
> +			warn("Couldn't configure user mappings");
> +		}
>  	}
>  
>  	if (argc == 0) {
> diff --git a/pasta.h b/pasta.h
> index 07e04b3..edd7747 100644
> --- a/pasta.h
> +++ b/pasta.h
> @@ -6,12 +6,13 @@
>  #ifndef PASTA_H
>  #define PASTA_H
>  
> +#include <stdbool.h>
>  #include <unistd.h>
>  
>  extern int pasta_child_pid;
>  
>  void pasta_open_ns(struct ctx *c, const char *netns);
> -void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
> +void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps,
>  		    int argc, char *argv[]);
>  void pasta_ns_conf(struct ctx *c);
>  void pasta_child_handler(int signal);
> -- 
> 2.55.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]