From 230a46b72be863e285ef57b09456e09b6fa6bf34 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Fri, 8 Jan 2021 14:08:12 +0900 Subject: [PATCH] systemd: fix rootful-in-userns regression shouldUseRootlessCgroupManager() was always returning true when we are inside a userns. If the systemd OwnerUID is 0, we have rootful systemd inside the userns, and we can just use the rootful cgroup driver. Fix #2724 Signed-off-by: Akihiro Suda --- rootless_linux.go | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/rootless_linux.go b/rootless_linux.go index 78d840dba..348f7c4ff 100644 --- a/rootless_linux.go +++ b/rootless_linux.go @@ -5,7 +5,9 @@ package main import ( "os" + "github.com/opencontainers/runc/libcontainer/cgroups/systemd" "github.com/opencontainers/runc/libcontainer/system" + "github.com/sirupsen/logrus" "github.com/urfave/cli" ) @@ -28,6 +30,23 @@ func shouldUseRootlessCgroupManager(context *cli.Context) (bool, error) { return false, nil } // euid = 0, in a userns. + // + // [systemd driver] + // We can call DetectUID() to parse the OwnerUID value from `busctl --user --no-pager status` result. + // The value corresponds to sd_bus_creds_get_owner_uid(3). + // If the value is 0, we have rootful systemd inside userns, so we do not need the rootless cgroup manager. + // + // On error, we assume we are root. An error may happen during shelling out to `busctl` CLI, + // mostly when $DBUS_SESSION_BUS_ADDRESS is unset. + if context.GlobalBool("systemd-cgroup") { + ownerUID, err := systemd.DetectUID() + if err != nil { + logrus.WithError(err).Debug("failed to get the OwnerUID value, assuming the value to be 0") + ownerUID = 0 + } + return ownerUID != 0, nil + } + // [cgroupfs driver] // As we are unaware of cgroups path, we can't determine whether we have the full // access to the cgroups path. // Either way, we can safely decide to use the rootless cgroups manager.