Re: [libvirt] [PATCH v3]LXC: Helper function for checking permission of dir when userns enabled

ping... > -----Original Message----- > From: libvir-list-bounces(a)redhat.com [mailto:libvir-list-bounces@redhat.com] > On Behalf Of Chen Hanxiao > Sent: Wednesday, October 09, 2013 6:03 PM > To: libvir-list(a)redhat.com > Subject: Re: [libvirt] [PATCH v3]LXC: Helper function for checking permission of > dir when userns enabled > > ping? > > > -----Original Message----- > > From: Chen Hanxiao [mailto:chenhanxiao@cn.fujitsu.com] > > Sent: Tuesday, September 10, 2013 4:18 PM > > To: libvir-list(a)redhat.com > > Cc: chenhanxiao(a)cn.fujitsu.com > > Subject: [libvirt][PATCH v3]LXC: Helper function for checking permission of dir > > when userns enabled > > > > From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com&gt; > > > > If we enable userns, the process with uid/gid in idmap > > should have enough permission to access dir we provided > > for containers. > > Currently, the debug log is very implicit > > or misleading sometimes. > > This patch will help clarify this for us > > when using debug log or virsh. > > > > v2: syntax-check clean > > > > v3: reliable method for checking permission of dir > > > > Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com&gt; > > --- > > src/lxc/lxc_container.c | 88 > > +++++++++++++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 88 insertions(+) > > > > diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c > > index 8abaea0..9a05e30 100644 > > --- a/src/lxc/lxc_container.c > > +++ b/src/lxc/lxc_container.c > > @@ -110,6 +110,13 @@ struct __lxc_child_argv { > > int handshakefd; > > }; > > > > +typedef struct __lxc_userns_DirPermCheck_argv > > lxc_userns_DirPermCheck_argv_t; > > +struct __lxc_userns_DirPermCheck_argv { > > + uid_t uid; > > + gid_t gid; > > + virDomainDefPtr vmDef; > > +}; > > + > > static int lxcContainerMountFSBlock(virDomainFSDefPtr fs, > > const char *srcprefix); > > > > @@ -1829,6 +1836,84 @@ lxcNeedNetworkNamespace(virDomainDefPtr > def) > > return false; > > } > > > > +static > > +int lxcContainerCheckDirPermissionChild(void *argv) > > +{ > > + size_t i; > > + lxc_userns_DirPermCheck_argv_t *args = argv; > > + uid_t uid = args->uid; > > + uid_t gid = args->gid; > > + virDomainDefPtr vmDef = args->vmDef; > > + char *path; > > + > > + if (virSetUIDGID(uid, gid, NULL, 0) < 0) { > > + virReportSystemError(errno, "%s", > > + _("setuid or setgid failed")); > > + _exit(-1); > > + } > > + > > + for (i = 0; i < vmDef->nfss; i++) { > > + path = vmDef->fss[i]->src; > > + if (access(path, R_OK) || access(path, W_OK) || > > virFileIsExecutable(path)) { > > + VIR_DEBUG("Src dir '%s' does not belong to uid/gid: %d/%d", > > + vmDef->fss[i]->src, uid, gid); > > + _exit(-1); > > + } > > + } > > + > > + _exit(0); > > +} > > + > > +/* > > + * Helper function for helping check > > + * whether we have enough privilege > > + * to operate the source dir when userns enabled > > + * @vmDef: pointer to vm definition structure > > + * Returns 0 on success or -1 in case of error > > + */ > > +static int > > +lxcContainerCheckDirPermission(virDomainDefPtr vmDef) > > +{ > > + uid_t uid; > > + gid_t gid; > > + int cpid = 0; > > + int status; > > + char *childStack; > > + char *stack; > > + int flags = SIGCHLD; > > + > > + uid = vmDef->idmap.uidmap[0].target; > > + gid = vmDef->idmap.gidmap[0].target; > > + > > + lxc_userns_DirPermCheck_argv_t args = { > > + .uid = uid, > > + .gid = gid, > > + .vmDef = vmDef > > + }; > > + > > + if (VIR_ALLOC_N(stack, getpagesize() * 4) < 0) > > + return -1; > > + > > + childStack = stack + (getpagesize() * 4); > > + cpid = clone(lxcContainerCheckDirPermissionChild, childStack, flags, > > &args); > > + VIR_FREE(stack); > > + if (cpid < 0) { > > + virReportSystemError(errno, "%s", > > + _("Unable to clone to check permission > of > > directory")); > > + return -1; > > + } else if (virProcessWait(cpid, &status) < 0) { > > + return -1; > > + } > > + > > + if (WEXITSTATUS(status) != 0) { > > + virReportSystemError(errno, "%s", > > + _("Check the permission of source dir > > provided for container")); > > + return -1; > > + } > > + > > + return 0; > > +} > > + > > /** > > * lxcContainerStart: > > * @def: pointer to virtual machine structure > > @@ -1880,6 +1965,9 @@ int lxcContainerStart(virDomainDefPtr def, > > if (userns_supported()) { > > VIR_DEBUG("Enable user namespace"); > > cflags |= CLONE_NEWUSER; > > + if (lxcContainerCheckDirPermission(def) < 0) { > > + return -1; > > + } > > } else { > > virReportSystemError(VIR_ERR_CONFIG_UNSUPPORTED, > > "%s", > > _("Kernel doesn't support user > > namespace")); > > -- > > 1.8.2.1