-
Notifications
You must be signed in to change notification settings - Fork 142
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix id mappings #531
Merged
Merged
Fix id mappings #531
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Mashimiao
commented
Dec 2, 2017
•
edited
Loading
edited
- the limit depends on different kernel version and not definitely required by spec
the limit depends on different kernel version and not definitely required by spec Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>
On Sat, Dec 02, 2017 at 05:48:16AM +0000, Ma Shimiao wrote:
1. the limit depends on different kernel version and not definitely
required by spec
+1 to this, so I'm in favor of your validate.go change.
2. uid and gid mappings must be set together
You're at least allowed to write uid_map without writing gid_map. As
an unprivileged user running ccon [1]:
$ cat config.json
{
"version": "0.4.0",
"namespaces": {
"user": {
"uidMappings": [
{
"containerID": 0,
"hostID": 1000,
"size": 1
}
]
}
},
"process": {
"args": [
"busybox",
"id"
]
}
}
$ ccon
uid=0(root) gid=65534(nobody) groups=65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody)
The above config maps my unprivileged user 1000 to 0 but left the
groups unmapped. And ‘busybox id’ can't handle it, but you can also
map the group while leaving the user unmapped:
$ cat config.json
{
"version": "0.4.0",
"namespaces": {
"user": {
"setgroups": false,
"gidMappings": [
{
"containerID": 0,
"hostID": 1000,
"size": 1
}
]
}
},
"process": {
"args": [
"/bin/echo",
"hello"
]
}
}
$ ccon
hello
so I'm not in favor of your validation changes.
This may also be related to your opencontainers/runc#1665 PR.
[1]: https://github.com/wking/ccon
|
Mashimiao
force-pushed
the
fix-id-mappings
branch
from
December 6, 2017 03:52
671ce23
to
e7ee761
Compare
I think unmapped users or groups may cause operation or security problem. But that needs to talk in runtime-spec. Just remove mapping limit this time. |
wking
approved these changes
Dec 6, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.