mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

specconv: temporarily allow userns path and mapping if they match

Browse Source 
It turns out that the error added in commit 09822c3da8 ("configs:
disallow ambiguous userns and timens configurations") causes issues with
containerd and CRIO because they pass both userns mappings and a userns
path.

These configurations are broken, but to avoid the regression in this one
case, output a warning to tell the user that the configuration is
incorrect but we will continue to use it if and only if the configured
mappings are identical to the mappings of the provided namespace.

Fixes: 09822c3da8 ("configs: disallow ambiguous userns and timens configurations")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
This commit is contained in:
Aleksa Sarai
2023-12-06 22:54:53 +11:00
parent 99f7fa1413
commit ebcef3e651
3 changed files with 36 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/specconv/spec_linux.go
+19 -5
View File
@@ -973,11 +973,6 @@ func setupUserNamespace(spec *specs.Spec, config *configs.Config) error {
config.GIDMappings = toConfigIDMap(spec.Linux.GIDMappings)
}
if path := config.Namespaces.PathOf(configs.NEWUSER); path != "" {
// We cannot allow uid or gid mappings to be set if we are also asked
// to join a userns.
if config.UIDMappings != nil || config.GIDMappings != nil {
return errors.New("user namespaces enabled, but both namespace path and mapping specified -- you may only provide one")
}
// Cache the current userns mappings in our configuration, so that we
// can calculate uid and gid mappings within runc. These mappings are
// never used for configuring the container if the path is set.
@@ -985,6 +980,25 @@ func setupUserNamespace(spec *specs.Spec, config *configs.Config) error {
if err != nil {
return fmt.Errorf("failed to cache mappings for userns: %w", err)
}
// We cannot allow uid or gid mappings to be set if we are also asked
// to join a userns.
if config.UIDMappings != nil || config.GIDMappings != nil {
// FIXME: It turns out that containerd and CRIO pass both a userns
// path and the mappings of the namespace in the same config.json.
// Such a configuration is technically not valid, but we used to
// require mappings be specified, and thus users worked around our
// bug -- so we can't regress it at the moment. But we also don't
// want to produce broken behaviour if the mapping doesn't match
// the userns. So (for now) we output a warning if the actual
// userns mappings match the configuration, otherwise we return an
// error.
if !userns.IsSameMapping(uidMap, config.UIDMappings) ||
!userns.IsSameMapping(gidMap, config.GIDMappings) {
return errors.New("user namespaces enabled, but both namespace path and non-matching mapping specified -- you may only provide one")
}
logrus.Warnf("config.json has both a userns path to join and a matching userns mapping specified -- you may only provide one. Future versions of runc may return an error with this configuration, please report a bug on <https://github.com/opencontainers/runc> if you see this warning and cannot update your configuration.")
}
config.UIDMappings = uidMap
config.GIDMappings = gidMap
logrus.WithFields(logrus.Fields{
libcontainer/specconv/spec_linux_test.go
+2 -2
View File
@@ -637,8 +637,8 @@ func TestUserNamespaceMappingAndPath(t *testing.T) {
Spec: spec,
})
if !strings.Contains(err.Error(), "user namespaces enabled, but both namespace path and mapping specified") {
t.Errorf("user namespace with mapping and namespace path should be forbidden")
if !strings.Contains(err.Error(), "both namespace path and non-matching mapping specified") {
t.Errorf("user namespace with path and non-matching mapping should be forbidden, got error %v", err)
}
}