crtxcr/exile.h
1
0
複製 0
程式碼 問題管理 14 合併請求 1 版本發佈 Wiki Activity

Allow specifying uid/gid to map in user namespace

瀏覽代碼
This commit is contained in:
Albert S.
2022-12-27 13:25:12 +01:00
父節點 f662398ac3
當前提交 44b9a17bec
共有 3 個文件被更改，包括 53 次插入 和 4 次删除
Download Patch File Download Diff File Expand all files Collapse all files

10
exile.c
查看文件

@ -625,6 +625,8 @@ struct exile_policy *exile_init_policy()
result->not_dumpable = 1;
result->no_new_privs = 1;
result->namespace_options = EXILE_UNSHARE_MOUNT | EXILE_UNSHARE_USER;
result->namespace_uid = 0;
result->namespace_gid = 0;
return result;
}
@ -938,7 +940,7 @@ void exile_free_policy(struct exile_policy *ctxt)
}
/* Enters the specified namespaces */
static int enter_namespaces(int namespace_options)
static int enter_namespaces(int namespace_options, uid_t namespace_uid, gid_t namespace_gid)
{
if(namespace_options & EXILE_UNSHARE_USER)
{
@ -975,7 +977,7 @@ static int enter_namespaces(int namespace_options)
EXILE_LOG_ERROR("Failed to open /proc/self/uid_map for writing");
return -1;
}
writesize = snprintf(buf, sizeof(buf), "0 %u 1\n", current_uid);
writesize = snprintf(buf, sizeof(buf), "%u %u 1\n", namespace_uid, current_uid);
writeret = write(fd, buf, writesize);
if(writeret < 0 || writeret < writesize)
{
@ -991,7 +993,7 @@ static int enter_namespaces(int namespace_options)
EXILE_LOG_ERROR("Failed to open /proc/self/gid_map for writing");
return -1;
}
writesize = snprintf(buf, sizeof(buf), "0 %u 1\n", current_gid);
writesize = snprintf(buf, sizeof(buf), "%u %u 1\n", namespace_gid, current_gid);
writeret = write(fd, buf, writesize);
if(writeret < 0 || writeret < writesize)
{
@ -1541,7 +1543,7 @@ int exile_enable_policy(struct exile_policy *policy)
close_file_fds();
}
if(enter_namespaces(policy->namespace_options) < 0)
if(enter_namespaces(policy->namespace_options, policy->namespace_uid, policy->namespace_gid) < 0)
{
EXILE_LOG_ERROR("Error while trying to enter namespaces\n");
return -1;