mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-10 21:53:57 +08:00
Akihiro Suda
06f789cf26
This PR decomposes `libcontainer/configs.Config.Rootless bool` into `RootlessEUID bool` and `RootlessCgroups bool`, so as to make "runc-in-userns" to be more compatible with "rootful" runc. `RootlessEUID` denotes that runc is being executed as a non-root user (euid != 0) in the current user namespace. `RootlessEUID` is almost identical to the former `Rootless` except cgroups stuff. `RootlessCgroups` denotes that runc is unlikely to have the full access to cgroups. `RootlessCgroups` is set to false if runc is executed as the root (euid == 0) in the initial namespace. Otherwise `RootlessCgroups` is set to true. (Hint: if `RootlessEUID` is true, `RootlessCgroups` becomes true as well) When runc is executed as the root (euid == 0) in an user namespace (e.g. by Docker-in-LXD, Podman, Usernetes), `RootlessEUID` is set to false but `RootlessCgroups` is set to true. So, "runc-in-userns" behaves almost same as "rootful" runc except that cgroups errors are ignored. This PR does not have any impact on CLI flags and `state.json`. Note about CLI: * Now `runc --rootless=(auto|true|false)` CLI flag is only used for setting `RootlessCgroups`. * Now `runc spec --rootless` is only required when `RootlessEUID` is set to true. For runc-in-userns, `runc spec` without `--rootless` should work, when sufficient numbers of UID/GID are mapped. Note about `$XDG_RUNTIME_DIR` (e.g. `/run/user/1000`): * `$XDG_RUNTIME_DIR` is ignored if runc is being executed as the root (euid == 0) in the initial namespace, for backward compatibility. (`/run/runc` is used) * If runc is executed as the root (euid == 0) in an user namespace, `$XDG_RUNTIME_DIR` is honored if `$USER != "" && $USER != "root"`. This allows unprivileged users to allow execute runc as the root in userns, without mounting writable `/run/runc`. Note about `state.json`: * `rootless` is set to true when `RootlessEUID == true && RootlessCgroups == true`. Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
58 lines
1.3 KiB
Go
58 lines
1.3 KiB
Go
// +build linux
|
|
|
|
package main
|
|
|
|
import (
|
|
"os"
|
|
|
|
"github.com/opencontainers/runc/libcontainer/system"
|
|
"github.com/urfave/cli"
|
|
)
|
|
|
|
func shouldUseRootlessCgroupManager(context *cli.Context) (bool, error) {
|
|
if context != nil {
|
|
b, err := parseBoolOrAuto(context.GlobalString("rootless"))
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
if b != nil {
|
|
return *b, nil
|
|
}
|
|
// nil b stands for "auto detect"
|
|
}
|
|
if context.GlobalBool("systemd-cgroup") {
|
|
return false, nil
|
|
}
|
|
if os.Geteuid() != 0 {
|
|
return true, nil
|
|
}
|
|
if !system.RunningInUserNS() {
|
|
// euid == 0 , in the initial ns (i.e. the real root)
|
|
return false, nil
|
|
}
|
|
// euid = 0, in a userns.
|
|
// As we are unaware of cgroups path, we can't determine whether we have the full
|
|
// access to the cgroups path.
|
|
// Either way, we can safely decide to use the rootless cgroups manager.
|
|
return true, nil
|
|
}
|
|
|
|
func shouldHonorXDGRuntimeDir() bool {
|
|
if os.Getenv("XDG_RUNTIME_DIR") == "" {
|
|
return false
|
|
}
|
|
if os.Geteuid() != 0 {
|
|
return true
|
|
}
|
|
if !system.RunningInUserNS() {
|
|
// euid == 0 , in the initial ns (i.e. the real root)
|
|
// in this case, we should use /run/runc and ignore
|
|
// $XDG_RUNTIME_DIR (e.g. /run/user/0) for backward
|
|
// compatibility.
|
|
return false
|
|
}
|
|
// euid = 0, in a userns.
|
|
u, ok := os.LookupEnv("USER")
|
|
return !ok || u != "root"
|
|
}
|