From c78f3f2ea0f732a4d95c54b4cfc1c237713dbf4d Mon Sep 17 00:00:00 2001 From: lifubang Date: Thu, 24 Oct 2024 22:17:54 +0800 Subject: [PATCH] libct/nsenter: become root after joining userns Containerd pre-creates userns and netns before calling runc, which results in the current code not working when SELinux is enabled, resulting in the following error: > runc create failed: unable to start container process: error during container init: error mounting "mqueue" to rootfs at "/dev/mqueue": setxattr /path/to/rootfs/dev/mqueue: operation not permitted The solution is to become root in the user namespace right after we join it. Fixes #4466. Co-authored-by: Wei Fu Co-authored-by: Kir Kolyshkin Co-authored-by: Aleksa Sarai Signed-off-by: lifubang --- libcontainer/nsenter/nsexec.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c index 74e15b96d..565b2ca20 100644 --- a/libcontainer/nsenter/nsexec.c +++ b/libcontainer/nsenter/nsexec.c @@ -505,6 +505,17 @@ void join_namespaces(char *nslist) if (setns(ns->fd, flag) < 0) bail("failed to setns into %s namespace", ns->type); + /* + * If we change user namespaces, make sure we switch to root in the + * namespace (this matches the logic for unshare(CLONE_NEWUSER)), lots + * of things can break if we aren't the right user. See + * for one example. + */ + if (flag == CLONE_NEWUSER) { + if (setresuid(0, 0, 0) < 0) + bail("failed to become root in user namespace"); + } + close(ns->fd); }