cmdline/config: make --enable_clone_newcgroup obsolete by enabling CLONE_NEWCGROUP...

diff --git a/cmdline.c b/cmdline.c
index 46c2e3123a7c08e473a24d5bc33eddfe015cdf39..5dbd8abad1fe942b6950670e6cd1b0c36fd2b548 100644 (file)
--- a/cmdline.c
+++ b/cmdline.c
@@ -109,7 +109,7 @@ struct custom_option custom_opts[] = {
     { { "disable_clone_newpid", no_argument, NULL, 0x0404 }, "Don't use CLONE_NEWPID" },
     { { "disable_clone_newipc", no_argument, NULL, 0x0405 }, "Don't use CLONE_NEWIPC" },
     { { "disable_clone_newuts", no_argument, NULL, 0x0406 }, "Don't use CLONE_NEWUTS" },
-    { { "enable_clone_newcgroup", no_argument, NULL, 0x0407 }, "Use CLONE_NEWCGROUP" },
+    { { "disable_clone_newcgroup", no_argument, NULL, 0x0407 }, "Don't use CLONE_NEWCGROUP. Might be required for kernel versions < 4.6" },
     { { "uid_mapping", required_argument, NULL, 'U' }, "Add a custom uid mapping of the form inside_uid:outside_uid:count. Setting this requires newuidmap (set-uid) to be present" },
     { { "gid_mapping", required_argument, NULL, 'G' }, "Add a custom gid mapping of the form inside_gid:outside_gid:count. Setting this requires newgidmap (set-uid) to be present" },
     { { "bindmount_ro", required_argument, NULL, 'R' }, "List of mountpoints to be mounted --bind (ro) inside the container. Can be specified multiple times. Supports 'source' syntax, or 'source:dest'" },
@@ -144,6 +144,7 @@ struct custom_option deprecated_opts[] = {
     { { "iface_vs_ip", required_argument, NULL, 0x701 }, "IP of the 'vs' interface (e.g. \"192.168.0.1\")" },
     { { "iface_vs_nm", required_argument, NULL, 0x702 }, "Netmask of the 'vs' interface (e.g. \"255.255.255.0\")" },
     { { "iface_vs_gw", required_argument, NULL, 0x703 }, "Default GW for the 'vs' interface (e.g. \"192.168.0.1\")" },
+    { { "enable_clone_newcgroup", no_argument, NULL, 0x0408 }, "Use CLONE_NEWCGROUP (it's enabled by default now)" },
 };
 // clang-format on
 
@@ -540,6 +541,9 @@ bool cmdlineParse(int argc, char* argv[], struct nsjconf_t* nsjconf) {
                        nsjconf->clone_newuts = false;
                        break;
                case 0x0407:
+                       nsjconf->clone_newcgroup = false;
+                       break;
+               case 0x0408:
                        nsjconf->clone_newcgroup = true;
                        break;
                case 0x0501:

diff --git a/config.proto b/config.proto
index 047eb967ed20b453cc4921c395b0848924e2f4f4..7254e0a25248d77f03c4022b9cc5c06d8c2da2aa 100644 (file)
--- a/config.proto
+++ b/config.proto
@@ -164,8 +164,8 @@ message NsJailConfig {
     optional bool clone_newpid = 49 [default = true];
     optional bool clone_newipc = 50 [default = true];
     optional bool clone_newuts = 51 [default = true];
-    /* It's only supported in newer kernels, hence disabled by default */
-    optional bool clone_newcgroup = 52 [default = false];
+    /* Disable for kernel versions < 4.6 as it's not supported there */
+    optional bool clone_newcgroup = 52 [default = true];
 
     /* Mappings for UIDs and GIDs. See the description for 'msg IdMap'
        for more */

diff --git a/subproc.c b/subproc.c
index 3c6f6e4fdd829088973ac7f981a248e3b9840907..54cd26647bdc22076a894424c2eec2da8e73ed0c 100644 (file)
--- a/subproc.c
+++ b/subproc.c
@@ -445,7 +445,7 @@ void subprocRunChild(struct nsjconf_t* nsjconf, int fd_in, int fd_out, int fd_er
        if (nsjconf->mode == MODE_STANDALONE_EXECVE) {
                LOG_D("Entering namespace with flags:%s", subprocCloneFlagsToStr(flags));
                if (unshare(flags) == -1) {
-                       PLOG_E("unshare(%#lx)", flags);
+                       PLOG_E("unshare(%s)", subprocCloneFlagsToStr(flags));
                        _exit(0xff);
                }
                subprocNewProc(nsjconf, fd_in, fd_out, fd_err, -1);
@@ -469,6 +469,11 @@ void subprocRunChild(struct nsjconf_t* nsjconf, int fd_in, int fd_out, int fd_er
        }
        close(child_fd);
        if (pid == -1) {
+               if (flags & CLONE_NEWCGROUP) {
+                       PLOG_E(
+                           "nsjail tried to use the CLONE_NEWCGROUP clone flag, which is "
+                           "supported under kernel versions >= 4.6 only. Try disabling this flag");
+               }
                PLOG_E(
                    "clone(flags=%s) failed. You probably need root privileges if your system "
                    "doesn't support CLONE_NEWUSER. Alternatively, you might want to recompile "