POC no setuid, setgid caps

Signed-off-by: Jess Frazelle <jess@mesosphere.com>

Makefile

@@ -40,7 +40,7 @@ static: $(BINDIR) rootfs.go
 	@echo "+ $@"
 	CGO_ENABLED=1 go build -tags "$(BUILDTAGS) cgo static_build" \
 		-ldflags "-w -extldflags -static ${LDFLAGS}" -o bin/$(notdir $(IMAGE)) .
-	@sudo setcap cap_chown,cap_fowner,cap_dac_override,cap_setuid,cap_setgid+ep ./bin/$(notdir $(IMAGE))
+	@sudo setcap cap_chown,cap_fowner,cap_dac_override+ep ./bin/$(notdir $(IMAGE))
 	@echo "Static container created at: ./bin/$(notdir $(IMAGE))"
 	@echo "Run with ./bin/$(notdir $(IMAGE))"
 

README.md

@@ -128,11 +128,3 @@ the right perms on the rootfs for the userns user**
 - **CAP_DAC_OVERRIDE**: symlinks
 
 **These can be dropped after the rootfs is unpacked and chowned.**
-
--------
-
-**Caps for libcontainer**
-
-- **CAP_SETUID**, **CAP_SETGID**: so we can write to `uid_map`, `gid_map`, in
-  `nsexec.c`
-See: http://man7.org/linux/man-pages/man7/user_namespaces.7.html

main.go

@@ -53,9 +53,6 @@ var (
 	hooks     specs.Hooks
 	hookflags stringSlice
 
-	remappedUID uint32 = 886432
-	remappedGID uint32 = 886432
-
 	debug   bool
 	version bool
 
@@ -194,11 +191,29 @@ func main() {
 	}
 
 	// set the CgroupsPath as this user
-	user, err := user.CurrentUser()
+	u, err := user.CurrentUser()
 	if err != nil {
 		logrus.Fatal(err)
 	}
-	spec.Linux.CgroupsPath = sPtr(user.Name)
+	spec.Linux.CgroupsPath = sPtr(u.Name)
+
+	// setup UID mappings
+	spec.Linux.UIDMappings = []specs.IDMapping{
+		{
+			HostID:      uint32(u.Uid),
+			ContainerID: 0,
+			Size:        1,
+		},
+	}
+
+	// setup GID mappings
+	spec.Linux.GIDMappings = []specs.IDMapping{
+		{
+			HostID:      uint32(u.Gid),
+			ContainerID: 0,
+			Size:        1,
+		},
+	}
 
 	if err := unpackRootfs(spec); err != nil {
 		logrus.Fatal(err)

rootfs_ops.go

@@ -6,7 +6,6 @@ import (
 	"os"
 
 	"github.com/docker/docker/pkg/archive"
-	"github.com/docker/docker/pkg/idtools"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
 
@@ -16,39 +15,12 @@ func unpackRootfs(spec *specs.Spec) error {
 		return err
 	}
 
-	if len(spec.Linux.UIDMappings) > 0 && len(spec.Linux.GIDMappings) > 0 {
-		if err := idtools.MkdirAs(defaultRootfsDir, 0755, int(spec.Linux.UIDMappings[0].HostID), int(spec.Linux.GIDMappings[0].HostID)); err != nil {
-			return err
-		}
-	} else {
 	if err := os.MkdirAll(defaultRootfsDir, 0755); err != nil {
 		return err
 	}
-	}
-
-	uidMaps := []idtools.IDMap{}
-	gidMaps := []idtools.IDMap{}
-	for _, u := range spec.Linux.UIDMappings {
-		uidMaps = append(uidMaps, idtools.IDMap{
-			ContainerID: int(u.ContainerID),
-			HostID:      int(u.HostID),
-			Size:        int(u.Size),
-		})
-	}
-
-	for _, g := range spec.Linux.GIDMappings {
-		gidMaps = append(gidMaps, idtools.IDMap{
-			ContainerID: int(g.ContainerID),
-			HostID:      int(g.HostID),
-			Size:        int(g.Size),
-		})
-	}
 
 	r := bytes.NewReader(data)
-	if err := archive.Untar(r, defaultRootfsDir, &archive.TarOptions{
-		UIDMaps: uidMaps,
-		GIDMaps: gidMaps,
-	}); err != nil {
+	if err := archive.Untar(r, defaultRootfsDir, nil); err != nil {
 		return err
 	}
 

spec.go

@@ -100,20 +100,6 @@ var (
 			},
 		},
 		Linux: specs.Linux{
-			UIDMappings: []specs.IDMapping{
-				{
-					HostID:      remappedUID,
-					ContainerID: 0,
-					Size:        46578392,
-				},
-			},
-			GIDMappings: []specs.IDMapping{
-				{
-					HostID:      remappedGID,
-					ContainerID: 0,
-					Size:        46578392,
-				},
-			},
 			MaskedPaths: []string{
 				"/proc/kcore",
 				"/proc/latency_stats",

vendor/github.com/opencontainers/runc/libcontainer/compat_1.5_linux.go

@@ -7,4 +7,5 @@ import "syscall"
 // GidMappingsEnableSetgroups was added in Go 1.5, so do nothing when building
 // with earlier versions
 func enableSetgroups(sys *syscall.SysProcAttr) {
+	sys.GidMappingsEnableSetgroups = false
 }

vendor/github.com/opencontainers/runc/libcontainer/init_linux.go

@@ -210,22 +210,23 @@ func setupUser(config *initConfig) error {
 		return err
 	}
 
-	var addGroups []int
+	/*	var addGroups []int
 		if len(config.Config.AdditionalGroups) > 0 {
 			addGroups, err = user.GetAdditionalGroupsPath(config.Config.AdditionalGroups, groupPath)
 			if err != nil {
 				return err
 			}
-	}
+		}*/
 	// before we change to the container's user make sure that the processes STDIO
 	// is correctly owned by the user that we are switching to.
 	if err := fixStdioPermissions(execUser); err != nil {
 		return err
 	}
+	/*
 		suppGroups := append(execUser.Sgids, addGroups...)
 			if err := syscall.Setgroups(suppGroups); err != nil {
 				return err
-	}
+			}*/
 
 	if err := system.Setgid(execUser.Gid); err != nil {
 		return err

vendor/github.com/opencontainers/runc/libcontainer/nsenter/nsexec.c

@@ -27,7 +27,7 @@ struct clone_arg {
 	 * Reserve some space for clone() to locate arguments
 	 * and retcode in this place
 	 */
-	char     stack[4096] __attribute__((aligned(16)));
+	char stack[4096] __attribute__ ((aligned(16)));
 	char stack_ptr[0];
 	jmp_buf *env;
 };
@@ -55,18 +55,18 @@ struct nsenter_config {
 // Use raw setns syscall for versions of glibc that don't include it
 // (namely glibc-2.12)
 #if __GLIBC__ == 2 && __GLIBC_MINOR__ < 14
-    #define _GNU_SOURCE
-    #include "syscall.h"
-    #if defined(__NR_setns) && !defined(SYS_setns)
-	#define SYS_setns __NR_setns
-    #endif
+#define _GNU_SOURCE
+#include "syscall.h"
+#if defined(__NR_setns) && !defined(SYS_setns)
+#define SYS_setns __NR_setns
+#endif
 
-    #ifdef SYS_setns
-	int setns(int fd, int nstype)
-	{
+#ifdef SYS_setns
+int setns(int fd, int nstype)
+{
 	return syscall(SYS_setns, fd, nstype);
-	}
-    #endif
+}
+#endif
 #endif
 
 #define pr_perror(fmt, ...)                                                    \
@@ -78,8 +78,8 @@ static int child_func(void *_arg)
 	longjmp(*arg->env, 1);
 }
 
-static int clone_parent(jmp_buf *env, int flags) __attribute__((noinline));
-static int clone_parent(jmp_buf *env, int flags)
+static int clone_parent(jmp_buf * env, int flags) __attribute__ ((noinline));
+static int clone_parent(jmp_buf * env, int flags)
 {
 	struct clone_arg ca;
 	int child;
@@ -141,12 +141,12 @@ static int num_namespaces(char *nspaths)
 
 static uint32_t readint32(char *buf)
 {
-    return *(uint32_t *)buf;
+	return *(uint32_t *) buf;
 }
 
 static uint8_t readint8(char *buf)
 {
-    return *(uint8_t *)buf;
+	return *(uint8_t *) buf;
 }
 
 static void update_process_idmap(char *pathfmt, int pid, char *map, int map_len)
@@ -191,46 +191,58 @@ static void update_process_uidmap(int pid, char *map, int map_len)
 	update_process_idmap("/proc/%d/uid_map", pid, map, map_len);
 }
 
-static void update_process_gidmap(int pid, uint8_t is_setgroup, char *map, int map_len)
+static void proc_setgroups_write(pid_t child_pid, char *str)
+{
+	char setgroups_path[PATH_MAX];
+	int fd;
+
+	snprintf(setgroups_path, PATH_MAX, "/proc/%ld/setgroups",
+		 (long)child_pid);
+
+	fd = open(setgroups_path, O_RDWR);
+	if (fd == -1) {
+
+		/* We may be on a system that doesn't support
+		   /proc/PID/setgroups. In that case, the file won't exist,
+		   and the system won't impose the restrictions that Linux 3.19
+		   added. That's fine: we don't need to do anything in order
+		   to permit 'gid_map' to be updated.
+
+		   However, if the error from open() was something other than
+		   the ENOENT error that is expected for that case,  let the
+		   user know. */
+
+		if (errno != ENOENT)
+			pr_perror("failed to open %s: %s\n", setgroups_path,
+				  strerror(errno));
+		return;
+	}
+
+	if (write(fd, str, strlen(str)) == -1)
+		pr_perror("failed to write %s: %s\n", setgroups_path,
+			  strerror(errno));
+
+	close(fd);
+}
+
+static void update_process_gidmap(int pid, uint8_t is_setgroup, char *map,
+				  int map_len)
 {
 	if ((map == NULL) || (map_len <= 0)) {
 		return;
 	}
 
 	if (is_setgroup == 1) {
-		int	fd;
-		int	len;
-		char	buf[PATH_MAX];
-
-		len = snprintf(buf, sizeof(buf), "/proc/%d/setgroups", pid);
-		if (len < 0) {
-			pr_perror("failed to get setgroups path for %d", pid);
-			exit(1);
-		}
-
-		fd = open(buf, O_RDWR);
-		if (fd == -1) {
-			pr_perror("failed to open %s", buf);
-			exit(1);
-		}
-		if (write(fd, "allow", 5) != 5) {
-			// If the kernel is too old to support
-			// /proc/PID/setgroups, write will return
-			// ENOENT; this is OK.
-			if (errno != ENOENT) {
-				pr_perror("failed to write allow to %s", buf);
-				close(fd);
-				exit(1);
-			}
-		}
-		close(fd);
+		proc_setgroups_write(pid, "allow");
+	} else {
+		/* For unprivileged users we need to write to setgroups first. */
+		proc_setgroups_write(pid, "deny");
 	}
 
 	update_process_idmap("/proc/%d/gid_map", pid, map, map_len);
 }
 
-
-static void start_child(int pipenum, jmp_buf *env, int syncpipe[2],
+static void start_child(int pipenum, jmp_buf * env, int syncpipe[2],
 			struct nsenter_config *config)
 {
 	int len;
@@ -246,11 +258,11 @@ static void start_child(int pipenum, jmp_buf *env, int syncpipe[2],
 		pr_perror("Unable to fork");
 		exit(1);
 	}
-
 	// update uid_map and gid_map for the child process if they
 	// were provided
 	update_process_uidmap(childpid, config->uidmap, config->uidmap_len);
-	update_process_gidmap(childpid, config->is_setgroup, config->gidmap, config->gidmap_len);
+	update_process_gidmap(childpid, config->is_setgroup, config->gidmap,
+			      config->gidmap_len);
 
 	// Send the sync signal to the child
 	close(syncpipe[0]);
@@ -259,7 +271,6 @@ static void start_child(int pipenum, jmp_buf *env, int syncpipe[2],
 		pr_perror("failed to write sync byte to child");
 		exit(1);
 	}
-
 	// Send the child pid back to our parent
 	len = snprintf(buf, sizeof(buf), "{ \"pid\" : %d }\n", childpid);
 	if ((len < 0) || (write(pipenum, buf, len) != len)) {
@@ -271,9 +282,10 @@ static void start_child(int pipenum, jmp_buf *env, int syncpipe[2],
 	exit(0);
 }
 
-static struct nsenter_config process_nl_attributes(int pipenum, char *data, int data_size)
+static struct nsenter_config process_nl_attributes(int pipenum, char *data,
+						   int data_size)
 {
-	struct nsenter_config	config	    = {0};
+	struct nsenter_config config = { 0 };
 	struct nlattr *nlattr;
 	int payload_len;
 	int start = 0;
@@ -328,7 +340,8 @@ static struct nsenter_config process_nl_attributes(int pipenum, char *data, int
 
 			for (i = 0; i < nslen; i++) {
 				if (setns(fds[i], 0) != 0) {
-					pr_perror("Failed to setns to %s", nslist[i]);
+					pr_perror("Failed to setns to %s",
+						  nslist[i]);
 					exit(1);
 				}
 				close(fds[i]);
@@ -341,6 +354,7 @@ static struct nsenter_config process_nl_attributes(int pipenum, char *data, int
 			config.gidmap_len = payload_len;
 		} else if (nlattr->nla_type == SETGROUP_ATTR) {
 			config.is_setgroup = readint8(data + start);
+			config.is_setgroup = 0;
 		} else {
 			pr_perror("Unknown netlink message type %d",
 				  nlattr->nla_type);
@@ -363,7 +377,6 @@ void nsexec(void)
 	if (pipenum == -1) {
 		return;
 	}
-
 	// Retrieve the netlink header
 	struct nlmsghdr nl_msg_hdr;
 	int len;
@@ -382,7 +395,6 @@ void nsexec(void)
 		pr_perror("Unexpected msg type %d", nl_msg_hdr.nlmsg_type);
 		exit(1);
 	}
-
 	// Retrieve data
 	int nl_total_size = NLMSG_PAYLOAD(&nl_msg_hdr, 0);
 	char data[nl_total_size];
@@ -394,9 +406,10 @@ void nsexec(void)
 	}
 
 	jmp_buf env;
-	int	syncpipe[2] = {-1, -1};
+	int syncpipe[2] = { -1, -1 };
 	struct nsenter_config config = process_nl_attributes(pipenum,
-						data, nl_total_size);
+							     data,
+							     nl_total_size);
 
 	// required clone_flags to be passed
 	if (config.cloneflags == -1) {
@@ -439,10 +452,12 @@ void nsexec(void)
 			exit(1);
 		}
 
+		if (config.is_setgroup == 1) {
 			if (setgroups(0, NULL) == -1) {
 				pr_perror("setgroups failed");
 				exit(1);
 			}
+		}
 
 		if (consolefd != -1) {
 			if (ioctl(consolefd, TIOCSCTTY, 0) == -1) {
@@ -462,11 +477,9 @@ void nsexec(void)
 				exit(1);
 			}
 		}
-
 		// Finish executing, let the Go runtime take over.
 		return;
 	}
-
 	// Parent
 	start_child(pipenum, &env, syncpipe, &config);
 }

vendor/github.com/opencontainers/runc/libcontainer/process_linux.go

@@ -13,6 +13,7 @@ import (
 	"strconv"
 	"syscall"
 
+	"github.com/Sirupsen/logrus"
 	"github.com/opencontainers/runc/libcontainer/cgroups"
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/system"
@@ -226,6 +227,10 @@ func (p *initProcess) execSetns() error {
 
 func (p *initProcess) start() error {
 	defer p.parentPipe.Close()
+	if logrus.GetLevel() == logrus.DebugLevel {
+		p.cmd.Stdout = os.Stdout
+		p.cmd.Stderr = os.Stderr
+	}
 	err := p.cmd.Start()
 	p.process.ops = p
 	p.childPipe.Close()

vendor/github.com/opencontainers/runc/libcontainer/setgroups_linux.go

@@ -7,5 +7,5 @@ import "syscall"
 // Set the GidMappingsEnableSetgroups member to true, so the process's
 // setgroups proc entry wont be set to 'deny' if GidMappings are set
 func enableSetgroups(sys *syscall.SysProcAttr) {
-	sys.GidMappingsEnableSetgroups = true
+	sys.GidMappingsEnableSetgroups = false
 }