diff options
author | Karel Zak | 2014-07-29 13:07:44 +0200 |
---|---|---|
committer | Karel Zak | 2014-07-29 13:07:44 +0200 |
commit | 47f42c1d14901b8bc2eb477fb0082bcbdd5e79af (patch) | |
tree | 12db1be2f2ac47a615f38f068c769c149b09b814 /sys-utils/nsenter.c | |
parent | tests: allow non-inotify tailf to keep up (diff) | |
download | kernel-qcow2-util-linux-47f42c1d14901b8bc2eb477fb0082bcbdd5e79af.tar.gz kernel-qcow2-util-linux-47f42c1d14901b8bc2eb477fb0082bcbdd5e79af.tar.xz kernel-qcow2-util-linux-47f42c1d14901b8bc2eb477fb0082bcbdd5e79af.zip |
nsenter: allow to use --set{uid,gid} for all namespaces
Now it's possible to set UID and GID for user namespaces only. This
patch removes this restriction and allow to use --set{uid,gid} in all
cases. The default for user namespaces is still GID=0, UID=0.
Reported-by: Tomas Doran <bobtfish@bobtfish.net>
Signed-off-by: Karel Zak <kzak@redhat.com>
Diffstat (limited to 'sys-utils/nsenter.c')
-rw-r--r-- | sys-utils/nsenter.c | 20 |
1 files changed, 13 insertions, 7 deletions
diff --git a/sys-utils/nsenter.c b/sys-utils/nsenter.c index d57edc81b..87c654939 100644 --- a/sys-utils/nsenter.c +++ b/sys-utils/nsenter.c @@ -73,8 +73,8 @@ static void usage(int status) fputs(_(" -n, --net [=<file>] enter network namespace\n"), out); fputs(_(" -p, --pid [=<file>] enter pid namespace\n"), out); fputs(_(" -U, --user [=<file>] enter user namespace\n"), out); - fputs(_(" -S, --setuid <uid> set uid in user namespace\n"), out); - fputs(_(" -G, --setgid <gid> set gid in user namespace\n"), out); + fputs(_(" -S, --setuid <uid> set uid in entered namespace\n"), out); + fputs(_(" -G, --setgid <gid> set gid in entered namespace\n"), out); fputs(_(" -r, --root [=<dir>] set the root directory\n"), out); fputs(_(" -w, --wd [=<dir>] set the working directory\n"), out); fputs(_(" -F, --no-fork do not fork before exec'ing <program>\n"), out); @@ -182,7 +182,7 @@ int main(int argc, char *argv[]) struct namespace_file *nsfile; int c, namespaces = 0; - bool do_rd = false, do_wd = false; + bool do_rd = false, do_wd = false, force_uid = false, force_gid = false; int do_fork = -1; /* unknown yet */ uid_t uid = 0; gid_t gid = 0; @@ -243,9 +243,11 @@ int main(int argc, char *argv[]) break; case 'S': uid = strtoul_or_err(optarg, _("failed to parse uid")); + force_uid = true; break; case 'G': gid = strtoul_or_err(optarg, _("failed to parse gid")); + force_gid = true; break; case 'F': do_fork = 0; @@ -328,12 +330,16 @@ int main(int argc, char *argv[]) if (do_fork == 1) continue_as_child(); - if (namespaces & CLONE_NEWUSER) { - if (setgroups(0, NULL)) /* drop supplementary groups */ + /* for user namespaces we always set UID and GID (default is 0) */ + if (namespaces & CLONE_NEWUSER) + force_uid = true, force_gid = true; + + if (force_uid || force_gid) { + if (force_gid && setgroups(0, NULL)) /* drop supplementary groups */ err(EXIT_FAILURE, _("setgroups failed")); - if (setgid(gid) < 0) + if (force_gid && setgid(gid) < 0) /* change GID */ err(EXIT_FAILURE, _("setgid failed")); - if (setuid(uid) < 0) + if (force_uid && setuid(uid) < 0) /* change UID */ err(EXIT_FAILURE, _("setuid failed")); } |