On 08/09/2013 01:53 PM, Chen Hanxiao wrote:
From: Chen Hanxiao<chenhanxiao@xxxxxxxxxxxxxx>
If we enable userns, the ownership of dir we provided for containers
should match the uid/gid in idmap.
Currently, the debug log is very implicit or misleading sometimes.
This patch will help clarify this for us when using
debug log or virsh.
Signed-off-by: Chen Hanxiao<chenhanxiao@xxxxxxxxxxxxxx>
---
src/lxc/lxc_container.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 45 insertions(+), 0 deletions(-)
diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
index b910b10..ce17466 100644
--- a/src/lxc/lxc_container.c
+++ b/src/lxc/lxc_container.c
@@ -1815,6 +1815,48 @@ lxcNeedNetworkNamespace(virDomainDefPtr def)
return false;
}
+/*
+ * Helper function for helping check
+ * whether we have enough privilege
+ * to operate the source dir when userns enabled
+ * @vmDef: pointer to vm definition structure
+ * Returns 0 on success or -1 in case of error
+ */
+static int
+lxcContainerUsernsSrcOwnershipCheck(virDomainDefPtr vmDef)
+{
+ struct stat buf;
+ int i;
+ uid_t uid;
+ gid_t gid;
+
+ for(i=0; i< vmDef->nfss; i++) {
+ VIR_DEBUG("dst is %s, src is %s",
+ vmDef->fss[i]->dst,
+ vmDef->fss[i]->src);
indention issue.
+
+ uid = vmDef->idmap.uidmap[0].target;
+ gid = vmDef->idmap.gidmap[0].target;
+
+ if (lstat(vmDef->fss[i]->src,&buf)< 0) {
+ virReportSystemError(errno, _("Cannot access '%s'"),
+ vmDef->fss[i]->src);
same as above.
+ return -1;
+ } else if(uid != buf.st_uid || gid != buf.st_gid) {
+ VIR_DEBUG("In userns uid is %d, gid is %d\n",
+ uid, gid);
same as above.
+ errno = EINVAL;
+
+ virReportSystemError(errno,
+ "[userns] Src dir \"%s\" does not belong to uid/gid:%d/%d",
+ vmDef->fss[i]->src, uid, gid);
same as above.
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
/**
* lxcContainerStart:
* @def: pointer to virtual machine structure
@@ -1866,6 +1908,9 @@ int lxcContainerStart(virDomainDefPtr def,
if (userns_supported()) {
VIR_DEBUG("Enable user namespace");
cflags |= CLONE_NEWUSER;
+ if(lxcContainerUsernsSrcOwnershipCheck(def)< 0) {
+ return -1;
+ }
} else {
virReportSystemError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("Kernel doesn't support user namespace"));
libvirt/.git/rebase-apply/patch:15: trailing whitespace.
* whether we have enough privilege
libvirt/.git/rebase-apply/patch:16: trailing whitespace.
* to operate the source dir when userns enabled
libvirt/.git/rebase-apply/patch:45: trailing whitespace.
virReportSystemError(errno,
libvirt/.git/rebase-apply/patch:51: trailing whitespace.
warning: 4 lines add whitespace errors.
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list