Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nsjail: fix path to new{u|g}idmap #51523

Merged
merged 1 commit into from Dec 4, 2018
Merged

nsjail: fix path to new{u|g}idmap #51523

merged 1 commit into from Dec 4, 2018

Conversation

c0bw3b
Copy link
Contributor

@c0bw3b c0bw3b commented Dec 4, 2018

Motivation for this change

Closes #51496
/cc @andrewchambers

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

Test (failed -- it's still up to the user to define valid rules in /etc/subuid and /etc/subgid )

$ sudo ./result/bin/nsjail -Mo -U demo:24000:1 / -- /run/current-system/sw/bin/echo "ABC"
[2018-12-04T21:28:19+0100] Mode: STANDALONE_ONCE
[2018-12-04T21:28:19+0100] Jail parameters: hostname:'NSJAIL', chroot:'', process:'/', bind:[::]:0, max_conns_per_ip:0, time_limit:0, personality:0, daemonize:false, clone_newnet:true, clone_newuser:true, clone_newns:true, clone_newpid:true, clone_newipc:true, clonew_newuts:true, clone_newcgroup:true, keep_caps:false, disable_no_new_privs:false, max_cpus:0
[2018-12-04T21:28:19+0100] Mount point: '/' flags:MS_RDONLY type:'tmpfs' options:'' is_dir:true
[2018-12-04T21:28:19+0100] Mount point: '/proc' flags:MS_RDONLY type:'proc' options:'' is_dir:true
[2018-12-04T21:28:19+0100] Uid map: inside_uid:1000 outside_uid:24000 count:1 newuidmap:true
[2018-12-04T21:28:19+0100] Gid map: inside_gid:0 outside_gid:0 count:1 newgidmap:false
[2018-12-04T21:28:19+0100] [W][14124] void cmdline::logParams(nsjconf_t*)():262 Process will be GID/EGID=0 in the global user namespace, and will have group root-level access to files
newuidmap: uid range [1000-1001) -> [24000-24001) not allowed
[2018-12-04T21:28:19+0100] [E][14124] bool user::uidMapExternal(nsjconf_t*, pid_t)():200 '/nix/store/y8gbyldjb042kyy46dsf84z8f0b2flhq-shadow-4.6/bin/newuidmap' failed
[2018-12-04T21:28:19+0100] [E][14124] bool subproc::initParent(nsjconf_t*, pid_t, int)():383 Couldn't initialize user namespace for pid 14125
[2018-12-04T21:28:19+0100] [E][14124] int nsjail::standaloneMode(nsjconf_t*)():146 Couldn't launch the child process
[2018-12-04T21:28:19+0100] [F][1] bool subproc::runChild(nsjconf_t*, int, int, int)():431 Launching child process failed

But at least calls to newuidmap or newgidmap are working as expected

@c0bw3b c0bw3b merged commit b38dd07 into NixOS:master Dec 4, 2018
@c0bw3b c0bw3b deleted the pkg/nsjail branch December 4, 2018 21:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
10.rebuild-darwin: 0 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@c0bw3b @GrahamcOfBorg