On Thu, Apr 25, 2013 at 06:01:02PM -0700, Eric W. Biederman wrote:
> Richard Weinberger <richard@xxxxxx> writes:
>
> > Using -S (--setuid) and -G (--setgid) one can select
> > the uid/gid which will be used in the entered user namespace.
>
> There is definitely utility here. I don't have a strong preference but
> I am inclined to suggest that you remove the set_uid and set_gid
> variables, and unconditionally call setuid and setgid when entering
> a user namespace.
I agree.
> > --- a/sys-utils/nsenter.c
> > +++ b/sys-utils/nsenter.c
> > @@ -72,6 +72,8 @@ static void usage(int status)
> > fputs(_(" -n, --net [=<file>] enter network namespace\n"), out);
> > fputs(_(" -p, --pid [=<file>] enter pid namespace\n"), out);
> > fputs(_(" -U, --user [=<file>] enter user namespace\n"), out);
> > + fputs(_(" -S, --setuid <uid> set uid in user namespace\n"), out);
> > + fputs(_(" -G, --setgid <gid> set gid in user namespace\n"), out);
Richard, update man page too. Please.
> > @@ -319,5 +335,15 @@ int main(int argc, char *argv[])
> > execvp(argv[optind], argv + optind);
> > err(EXIT_FAILURE, _("failed to execute %s"), argv[optind]);
> > }
> > +
> > + if (namespaces & CLONE_NEWUSER) {
> > + if (set_uid)
> > + if (setuid(uid) < 0)
> > + err(EXIT_FAILURE, _("setuid failed"));
> > + if (set_gid)
> > + if (setgid(gid) < 0)
> > + err(EXIT_FAILURE, _("setgid failed"));
> > + }
> > +
> > exec_shell();
Why do call setuid/gid() only for shell? Would be better to move all
this code before the block with execvp() to call setuid/gid() for
all execvp() as well as for exec_shell()?
Karel
--
Karel Zak <kzak@xxxxxxxxxx>
http://karelzak.blogspot.com
--
To unsubscribe from this list: send the line "unsubscribe util-linux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
