public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

buildFhsUserenv: don't downgrade root user

Browse Source
This commit is contained in:
Jörg Thalheim 2020-12-08 12:10:47 +01:00
parent 6722232b96
commit c56fbe4e09
No known key found for this signature in database
GPG Key ID: 003F2096411B5F92
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkgs/build-support/build-fhs-userenv/chrootenv/chrootenv.c
View File

@ -43,6 +43,7 @@ const gchar *create_tmpdir() {
void pivot_host(const gchar *guest) { void pivot_host(const gchar *guest) {
g_autofree gchar *point = g_build_filename(guest, "host", NULL); g_autofree gchar *point = g_build_filename(guest, "host", NULL);
fail_if(g_mkdir(point, 0755)); fail_if(g_mkdir(point, 0755));
fail_if(mount(0, "/", 0, MS_PRIVATE | MS_REC, 0));
fail_if(pivot_root(guest, point)); fail_if(pivot_root(guest, point));
} }
@ -56,6 +57,7 @@ void bind_mount_item(const gchar *host, const gchar *guest, const gchar *name) {
void bind(const gchar *host, const gchar *guest) { void bind(const gchar *host, const gchar *guest) {
mount_tmpfs(guest); mount_tmpfs(guest);
pivot_host(guest); pivot_host(guest);
g_autofree gchar *host_dir = g_build_filename("/host", host, NULL); g_autofree gchar *host_dir = g_build_filename("/host", host, NULL);
@ -105,7 +107,11 @@ int main(gint argc, gchar **argv) {
uid_t uid = getuid(); uid_t uid = getuid();
gid_t gid = getgid(); gid_t gid = getgid();
if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) { int namespaces = CLONE_NEWNS;
if (uid != 0) {
namespaces |= CLONE_NEWUSER;
}
if (unshare(namespaces) < 0) {
int unshare_errno = errno; int unshare_errno = errno;
g_message("Requires Linux version >= 3.19 built with CONFIG_USER_NS"); g_message("Requires Linux version >= 3.19 built with CONFIG_USER_NS");
@ -116,9 +122,11 @@ int main(gint argc, gchar **argv) {
fail("unshare", unshare_errno); fail("unshare", unshare_errno);
} }
spit("/proc/self/setgroups", "deny"); if (uid != 0) {
spit("/proc/self/uid_map", "%d %d 1", uid, uid); spit("/proc/self/setgroups", "deny");
spit("/proc/self/gid_map", "%d %d 1", gid, gid); spit("/proc/self/uid_map", "%d %d 1", uid, uid);
spit("/proc/self/gid_map", "%d %d 1", gid, gid);
}
// If there is a /host directory, assume this is nested chrootenv and use it as host instead. // If there is a /host directory, assume this is nested chrootenv and use it as host instead.
gboolean nested_host = g_file_test("/host", G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR); gboolean nested_host = g_file_test("/host", G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR);