We need PR_SET_DUMPABLE in order to write the mapping files when
creating a userns. From prctl(2) PR_SET_DUMPABLE is reset when the
process's effective user or group ID is changed.
As we are changing the EUID here, we also reset it to allow creating
nested userns with subsequent switch_users() calls.
This was not causing any issues because we weren't using switch_users()
to create nested userns. Nested userns were created with
userns_fd_cb()/create_userns_hierarchy() that set PR_SET_DUMPABLE.
Future patches will rely on switch_users() to create nested userns. So
this patch fixes that.
Signed-off-by: Rodrigo Campos <rodrigo@xxxxxxxxxxx>
Reviewed-by: Christian Brauner <brauner@xxxxxxxxxx>
---
src/vfs/utils.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git src/vfs/utils.c src/vfs/utils.c
index 2331a3b7..9e67ac37 100644
--- src/vfs/utils.c
+++ src/vfs/utils.c
@@ -286,6 +286,10 @@ bool switch_ids(uid_t uid, gid_t gid)
if (setresuid(uid, uid, uid))
return syserror("failure: setresuid");
+ /* Ensure we can access proc files from processes we can ptrace. */
+ if (prctl(PR_SET_DUMPABLE, 1, 0, 0, 0))
+ return syserror("failure: make dumpable");
+
return true;
}
@@ -303,11 +307,6 @@ static int userns_fd_cb(void *data)
if (c == '1') {
if (!switch_ids(0, 0))
return syserror("failure: switch ids to 0");
-
- /* Ensure we can access proc files from processes we can ptrace. */
- ret = prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
- if (ret < 0)
- return syserror("failure: make dumpable");
}
ret = write_nointr(h->fd_event, "1", 1);
--
2.39.2
