From 21a005d074ad5a801d7818153fb236e3b07b039c Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 12 Jul 2017 05:53:38 +1000 Subject: [PATCH 1/2] list: stop casting unknown UIDs to their unicode values If a container is owned by a UID that is not listed in /etc/passwd, previously we would cast the UID to a string which contained a character with the unicode value of the UID. This is clearly wrong, switch to using fmt.Sprintf as intended. In addition, notate unknown users with a leading '#' in the column. This is necessary to ensure that a user is not under the impression that the UID is the same as a numeric username. Signed-off-by: Aleksa Sarai --- list.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/list.go b/list.go index 1c3b9aa83..0313d8cc2 100644 --- a/list.go +++ b/list.go @@ -135,7 +135,7 @@ func getContainers(context *cli.Context) ([]containerState, error) { stat := item.Sys().(*syscall.Stat_t) owner, err := user.LookupUid(int(stat.Uid)) if err != nil { - owner.Name = string(stat.Uid) + owner.Name = fmt.Sprintf("#%d", stat.Uid) } container, err := factory.Load(item.Name()) From 7cfb107f2c5be3cf1368d38d70845fbaec5958a8 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 12 Jul 2017 06:27:01 +1000 Subject: [PATCH 2/2] factory: use e{u,g}id as the owner of /run/runc/$id It appears as though these semantics were not fully thought out when implementing them for rootless containers. It is not necessary (and could be potentially dangerous) to set the owner of /run/ctr/$id to be the root inside the container (if user namespaces are being used). Instead, just use the e{g,u}id of runc to determine the owner. Signed-off-by: Aleksa Sarai --- libcontainer/factory_linux.go | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/libcontainer/factory_linux.go b/libcontainer/factory_linux.go index 72af513f2..42b6f5a05 100644 --- a/libcontainer/factory_linux.go +++ b/libcontainer/factory_linux.go @@ -162,14 +162,6 @@ func (l *LinuxFactory) Create(id string, config *configs.Config) (Container, err if err := l.Validator.Validate(config); err != nil { return nil, newGenericError(err, ConfigInvalid) } - uid, err := config.HostRootUID() - if err != nil { - return nil, newGenericError(err, SystemError) - } - gid, err := config.HostRootGID() - if err != nil { - return nil, newGenericError(err, SystemError) - } containerRoot := filepath.Join(l.Root, id) if _, err := os.Stat(containerRoot); err == nil { return nil, newGenericError(fmt.Errorf("container with id exists: %v", id), IdInUse) @@ -179,7 +171,7 @@ func (l *LinuxFactory) Create(id string, config *configs.Config) (Container, err if err := os.MkdirAll(containerRoot, 0711); err != nil { return nil, newGenericError(err, SystemError) } - if err := os.Chown(containerRoot, uid, gid); err != nil { + if err := os.Chown(containerRoot, unix.Geteuid(), unix.Getegid()); err != nil { return nil, newGenericError(err, SystemError) } if config.Rootless {