mount: allow to use --disable_newuser for root users

diff --git a/caps.c b/caps.c
index 87d345a24db4eada552f10e1e6fb742ab257f782..4a5cc091886c7ebef8038e537460537f289caf13 100644 (file)
--- a/caps.c
+++ b/caps.c
@@ -209,6 +209,9 @@ static bool CapsInitNsKeepCaps(cap_user_data_t cap_data)
 
 bool capsInitNs(struct nsjconf_t * nsjconf)
 {
+       char dbgmsg[4096];
+       struct ints_t *p;
+
        cap_user_data_t cap_data = capsGet();
        if (cap_data == NULL) {
                return false;
@@ -220,11 +223,8 @@ bool capsInitNs(struct nsjconf_t * nsjconf)
                return CapsInitNsKeepCaps(cap_data);
        }
 
-       char dbgmsg[4096];
-       dbgmsg[0] = '\0';
-
        /* Set all requested caps in the inheritable set if these are present in the permitted set */
-       struct ints_t *p;
+       dbgmsg[0] = '\0';
        TAILQ_FOREACH(p, &nsjconf->caps, pointers) {
                if (capsGetPermitted(cap_data, p->val) == false) {
                        LOG_W("Capability %s is not permitted in the namespace",
@@ -235,22 +235,6 @@ bool capsInitNs(struct nsjconf_t * nsjconf)
                capsSetInheritable(cap_data, p->val);
        }
        LOG_D("Adding the following capabilities to the inheritable set:%s", dbgmsg);
-       if (capsSet(cap_data) == false) {
-               return false;
-       }
-
-       /* Make sure inheritable set is preserved across execve via the modified ambient set */
-       dbgmsg[0] = '\0';
-       TAILQ_FOREACH(p, &nsjconf->caps, pointers) {
-               if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, (unsigned long)p->val, 0UL, 0UL) ==
-                   -1) {
-                       PLOG_W("prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, %s)",
-                              capsValToStr(p->val));
-               } else {
-                       utilSSnPrintf(dbgmsg, sizeof(dbgmsg), " %s", capsValToStr(p->val));
-               }
-       }
-       LOG_D("Added the following capabilities to the ambient set:%s", dbgmsg);
 
        /*
         * Make sure all other caps (those which were not explicitly requested) are removed from the
@@ -269,5 +253,23 @@ bool capsInitNs(struct nsjconf_t * nsjconf)
        }
        LOG_D("Dropped the following capabilities from the bounding set:%s", dbgmsg);
 
+       /* Must be performed after CAPBSET has been manipulated */
+       if (capsSet(cap_data) == false) {
+               return false;
+       }
+
+       /* Make sure inheritable set is preserved across execve via the modified ambient set */
+       dbgmsg[0] = '\0';
+       TAILQ_FOREACH(p, &nsjconf->caps, pointers) {
+               if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, (unsigned long)p->val, 0UL, 0UL) ==
+                   -1) {
+                       PLOG_W("prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, %s)",
+                              capsValToStr(p->val));
+               } else {
+                       utilSSnPrintf(dbgmsg, sizeof(dbgmsg), " %s", capsValToStr(p->val));
+               }
+       }
+       LOG_D("Added the following capabilities to the ambient set:%s", dbgmsg);
+
        return true;
 }

diff --git a/contain.c b/contain.c
index 6987f9f686848eb6a0fab68a3584489c61ad0c70..29570020a537baa14b52eb45bd4cab60342857ec 100644 (file)
--- a/contain.c
+++ b/contain.c
@@ -89,6 +89,30 @@ static bool containDropPrivs(struct nsjconf_t *nsjconf)
                        PLOG_W("prctl(PR_SET_NO_NEW_PRIVS, 1)");
                }
        }
+
+       if (nsjconf->clone_newuser == false) {
+               LOG_D("setresgid(%d, %d, %d)", TAILQ_FIRST(&nsjconf->gids)->inside_id,
+                     TAILQ_FIRST(&nsjconf->gids)->inside_id,
+                     TAILQ_FIRST(&nsjconf->gids)->inside_id);
+               if (syscall(__NR_setresgid, TAILQ_FIRST(&nsjconf->gids)->inside_id,
+                           TAILQ_FIRST(&nsjconf->gids)->inside_id,
+                           TAILQ_FIRST(&nsjconf->gids)->inside_id)
+                   == -1) {
+                       PLOG_E("setresgid(%u)", TAILQ_FIRST(&nsjconf->gids)->inside_id);
+                       return false;
+               }
+               LOG_D("setresuid(%d, %d, %d)", TAILQ_FIRST(&nsjconf->uids)->inside_id,
+                     TAILQ_FIRST(&nsjconf->uids)->inside_id,
+                     TAILQ_FIRST(&nsjconf->uids)->inside_id);
+               if (syscall(__NR_setresuid, TAILQ_FIRST(&nsjconf->uids)->inside_id,
+                           TAILQ_FIRST(&nsjconf->uids)->inside_id,
+                           TAILQ_FIRST(&nsjconf->uids)->inside_id)
+                   == -1) {
+                       PLOG_E("setresuid(%u)", TAILQ_FIRST(&nsjconf->uids)->inside_id);
+                       return false;
+               }
+       }
+
        if (capsInitNs(nsjconf) == false) {
                return false;
        }

diff --git a/mount.c b/mount.c
index 86b4e42dc17677a064112cbdaf12e52926c4e236..7d597c0eed9529e66fb5fe4438300e7de6d9fe89 100644 (file)
--- a/mount.c
+++ b/mount.c
@@ -314,8 +314,8 @@ static bool mountInitNsInternal(struct nsjconf_t *nsjconf)
                return false;
        }
 
-       if (mount("/", "/", NULL, MS_BIND | MS_REC | MS_PRIVATE | MS_REMOUNT, NULL) == -1) {
-               PLOG_E("mount('/', '/', NULL, MS_BIND|MS_REC|MS_PRIVATE|MS_REMOUNT, NULL)");
+       if (mount("/", "/", NULL, MS_REC | MS_PRIVATE, NULL) == -1) {
+               PLOG_E("mount('/', '/', NULL, MS_REC|MS_PRIVATE, NULL)");
                return false;
        }
        if (mount(NULL, destdir, "tmpfs", 0, "size=16777216") == -1) {

diff --git a/user.c b/user.c
index c4fdeac08bf2c1a32ac8b0bd90caf2b85ff6f22d..bd207cd999c02bd0ed7e42c3acedf9cb209f4d04 100644 (file)
--- a/user.c
+++ b/user.c
@@ -263,6 +263,11 @@ bool userInitNsFromChild(struct nsjconf_t * nsjconf)
        if (setgroups(0, group_list) == -1) {
                PLOG_D("setgroups(NULL) failed");
        }
+
+       if (nsjconf->clone_newuser == false) {
+               return true;
+       }
+
        LOG_D("setresgid(%d, %d, %d)", TAILQ_FIRST(&nsjconf->gids)->inside_id,
              TAILQ_FIRST(&nsjconf->gids)->inside_id, TAILQ_FIRST(&nsjconf->gids)->inside_id);
        if (syscall(__NR_setresgid, TAILQ_FIRST(&nsjconf->gids)->inside_id,