01/05: pack: Relocatable wrapper now properly maps the current UID/GID.

[Ludovic Courtès]

civodul pushed a commit to branch master
in repository guix.

commit 30da3173d5ee69777d0e1de4f9c977dea72e8a77
Author: Ludovic Courtès <address@hidden>
Date:   Fri May 11 16:41:35 2018 +0200

    pack: Relocatable wrapper now properly maps the current UID/GID.
    
    * gnu/packages/aux-files/run-in-namespace.c (write_id_map)
    (disallow_setgroups): New functions.
    (main): Use 'clone' via 'syscall' instead of 'fork' followed by
    'unshare'.  Add calls to 'disallow_setgroups' and 'write_id_map' in the
    parent process.
---
 gnu/packages/aux-files/run-in-namespace.c | 87 ++++++++++++++++++++++++-------
 1 file changed, 68 insertions(+), 19 deletions(-)

diff --git a/gnu/packages/aux-files/run-in-namespace.c 
b/gnu/packages/aux-files/run-in-namespace.c
index d0ab05c..f0cff88 100644
--- a/gnu/packages/aux-files/run-in-namespace.c
+++ b/gnu/packages/aux-files/run-in-namespace.c
@@ -40,6 +40,7 @@
 #include <sys/wait.h>
 #include <fcntl.h>
 #include <dirent.h>
+#include <sys/syscall.h>
 
 /* Concatenate DIRECTORY, a slash, and FILE.  Return the result, which the
    caller must eventually free.  */
@@ -168,6 +169,48 @@ bind_mount (const char *source, const char *target)
   closedir (stream);
 }
 
+/* Write the user/group ID map for PID to FILE, mapping ID to itself.  See
+   user_namespaces(7).  */
+static void
+write_id_map (pid_t pid, const char *file, int id)
+{
+  char id_map_file[100];
+  snprintf (id_map_file, sizeof id_map_file, "/proc/%d/%s", pid, file);
+
+  char id_map[100];
+
+  /* Map root and the current user.  */
+  int len = snprintf (id_map, sizeof id_map, "%d %d 1\n", id, id);
+  int fd = open (id_map_file, O_WRONLY);
+  if (fd < 0)
+    assert_perror (errno);
+
+  int n = write (fd, id_map, len);
+  if (n < 0)
+    assert_perror (errno);
+
+  close (fd);
+}
+
+/* Disallow setgroups(2) for PID.  */
+static void
+disallow_setgroups (pid_t pid)
+{
+  char file[100];
+
+  snprintf (file, sizeof file, "/proc/%d/setgroups", pid);
+
+  int fd = open (file, O_WRONLY);
+  if (fd < 0)
+    assert_perror (errno);
+
+  int err = write (fd, "deny", 5);
+  if (err < 0)
+    assert_perror (errno);
+
+  close (fd);
+}
+
 
 int
 main (int argc, char *argv[])
@@ -201,26 +244,16 @@ main (int argc, char *argv[])
       char *new_store = concat (new_root, "@STORE_DIRECTORY@");
       char *cwd = get_current_dir_name ();
 
-      pid_t child = fork ();
+      /* Create a child with separate namespaces and set up bind-mounts from
+        there.  That way, bind-mounts automatically disappear when the child
+        exits, which simplifies cleanup for the parent.  Note: clone is more
+        convenient than fork + unshare since the parent can directly write
+        the child uid_map/gid_map files.  */
+      pid_t child = syscall (SYS_clone, SIGCHLD | CLONE_NEWNS | CLONE_NEWUSER,
+                            NULL, NULL, NULL);
       switch (child)
        {
        case 0:
-         /* Unshare namespaces in the child and set up bind-mounts from
-            there.  That way, bind-mounts automatically disappear when the
-            child exits, which simplifies cleanup for the parent.  */
-         err = unshare (CLONE_NEWNS | CLONE_NEWUSER);
-         if (err < 0)
-           {
-             fprintf (stderr, "%s: error: 'unshare' failed: %m\n", argv[0]);
-             fprintf (stderr, "\
-This may be because \"user namespaces\" are not supported on this system.\n\
-Consequently, we cannot run '@WRAPPED_PROGRAM@',\n\
-unless you move it to the '@STORE_DIRECTORY@' directory.\n\
-\n\
-Please refer to the 'guix pack' documentation for more information.\n");
-             return EXIT_FAILURE;
-           }
-
          /* Note: Due to <https://bugzilla.kernel.org/show_bug.cgi?id=183461>
             we cannot make NEW_ROOT a tmpfs (which would have saved the need
             for 'rm_rf'.)  */
@@ -239,11 +272,27 @@ Please refer to the 'guix pack' documentation for more 
information.\n");
          /* Change back to where we were before chroot'ing.  */
          chdir (cwd);
          break;
+
        case -1:
-         assert_perror (errno);
-         break;
+         fprintf (stderr, "%s: error: 'clone' failed: %m\n", argv[0]);
+         fprintf (stderr, "\
+This may be because \"user namespaces\" are not supported on this system.\n\
+Consequently, we cannot run '@WRAPPED_PROGRAM@',\n\
+unless you move it to the '@STORE_DIRECTORY@' directory.\n\
+\n\
+Please refer to the 'guix pack' documentation for more information.\n");
+         return EXIT_FAILURE;
+
        default:
          {
+           /* Map the current user/group ID in the child's namespace (the
+              default is to get the "overflow UID", i.e., the UID of
+              "nobody").  We must first disallow 'setgroups' for that
+              process.  */
+           disallow_setgroups (child);
+           write_id_map (child, "uid_map", getuid ());
+           write_id_map (child, "gid_map", getgid ());
+
            int status;
            waitpid (child, &status, 0);
            chdir ("/");                          /* avoid EBUSY */