pyrox.dev
lol
chrootenv-user: don't unshare user namespace if we are root
+25
-14
pkgs/build-support/build-fhs-userenv/chroot-user.rb
+25
-14
pkgs/build-support/build-fhs-userenv/chroot-user.rb
···
53
53
54
54
MS_BIND = 0x1000
55
55
MS_REC = 0x4000
56
+
MS_SLAVE = 0x80000
56
57
$mount = make_fcall 'mount', [Fiddle::TYPE_VOIDP,
57
58
Fiddle::TYPE_VOIDP,
58
59
Fiddle::TYPE_VOIDP,
···
92
93
# we don't use threads at all.
93
94
$cpid = $fork.call
94
95
if $cpid == 0
95
-
# Save user UID and GID
96
-
uid = Process.uid
97
-
gid = Process.gid
96
+
# If we are root, no need to create new user namespace.
97
+
if Process.uid == 0
98
+
$unshare.call CLONE_NEWNS
99
+
# Mark all mounted filesystems as slave so changes
100
+
# don't propagate to the parent mount namespace.
101
+
$mount.call nil, '/', nil, MS_REC | MS_SLAVE, nil
102
+
else
103
+
# Save user UID and GID
104
+
uid = Process.uid
105
+
gid = Process.gid
98
106
99
-
# Create new mount and user namespaces
100
-
# CLONE_NEWUSER requires a program to be non-threaded, hence
101
-
# native fork above.
102
-
$unshare.call CLONE_NEWNS | CLONE_NEWUSER
107
+
# Create new mount and user namespaces
108
+
# CLONE_NEWUSER requires a program to be non-threaded, hence
109
+
# native fork above.
110
+
$unshare.call CLONE_NEWNS | CLONE_NEWUSER
103
111
104
-
# Map users and groups to the parent namespace
105
-
begin
106
-
# setgroups is only available since Linux 3.19
107
-
write_file '/proc/self/setgroups', 'deny'
108
-
rescue
112
+
# Map users and groups to the parent namespace
113
+
begin
114
+
# setgroups is only available since Linux 3.19
115
+
write_file '/proc/self/setgroups', 'deny'
116
+
rescue
117
+
end
118
+
write_file '/proc/self/uid_map', "#{uid} #{uid} 1"
119
+
write_file '/proc/self/gid_map', "#{gid} #{gid} 1"
109
120
end
110
-
write_file '/proc/self/uid_map', "#{uid} #{uid} 1"
111
-
write_file '/proc/self/gid_map', "#{gid} #{gid} 1"
112
121
113
122
# Do rbind mounts.
114
123
mounts.each do |from, rto|
···
117
126
$mount.call from, to, nil, MS_BIND | MS_REC, nil
118
127
end
119
128
129
+
# Don't make root private so privilege drops inside chroot are possible
130
+
File.chmod(0755, root)
120
131
# Chroot!
121
132
Dir.chroot root
122
133
Dir.chdir '/'