lxcpp: UID/GID setting in Attach

[Feature]       UID/GID setting
[Cause]         N/A
[Solution]      N/A
[Verification]  Build, install, run tests

Change-Id: Iaa83cab137df53a1391f01c0a29ef236da030aee

diff --git a/libs/lxcpp/commands/attach.cpp b/libs/lxcpp/commands/attach.cpp
index 98a4599..0ff856e 100644 (file)
--- a/libs/lxcpp/commands/attach.cpp
+++ b/libs/lxcpp/commands/attach.cpp
@@ -28,6 +28,7 @@
 #include "lxcpp/namespace.hpp"
 #include "lxcpp/capability.hpp"
 #include "lxcpp/environment.hpp"
+#include "lxcpp/credentials.hpp"
 
 #include "utils/exception.hpp"
 
@@ -80,12 +81,18 @@ int execFunction(void* call)
 
 Attach::Attach(lxcpp::ContainerImpl& container,
                Container::AttachCall& userCall,
+               const uid_t uid,
+               const gid_t gid,
+               const std::vector<gid_t>& supplementaryGids,
                const int capsToKeep,
                const std::string& workDirInContainer,
                const std::vector<std::string>& envToKeep,
                const std::vector<std::pair<std::string, std::string>>& envToSet)
     : mContainer(container),
       mUserCall(userCall),
+      mUid(uid),
+      mGid(gid),
+      mSupplementaryGids(supplementaryGids),
       mCapsToKeep(capsToKeep),
       mWorkDirInContainer(workDirInContainer),
       mEnvToKeep(envToKeep),
@@ -104,6 +111,9 @@ void Attach::execute()
 
     Call call = std::bind(&Attach::child,
                           mUserCall,
+                          mUid,
+                          mGid,
+                          mSupplementaryGids,
                           mCapsToKeep,
                           mEnvToKeep,
                           mEnvToSet);
@@ -122,20 +132,29 @@ void Attach::execute()
 }
 
 int Attach::child(const Container::AttachCall& call,
+                  const uid_t uid,
+                  const gid_t gid,
+                  const std::vector<gid_t>& supplementaryGids,
                   const int capsToKeep,
                   const std::vector<std::string>& envToKeep,
                   const std::vector<std::pair<std::string, std::string>>& envToSet)
 {
-    // Setup capabilities
-    dropCapsFromBoundingExcept(capsToKeep);
-
     // Setup /proc /sys mount
     setupMountPoints();
 
+    // Setup capabilities
+    dropCapsFromBoundingExcept(capsToKeep);
+
     // Setup environment variables
     clearenvExcept(envToKeep);
     setenv(envToSet);
 
+    // Set uid/gids
+    lxcpp::setgid(gid);
+    setgroups(supplementaryGids);
+
+    lxcpp::setuid(uid);
+
     // Run user's code
     return call();
 }

diff --git a/libs/lxcpp/commands/attach.hpp b/libs/lxcpp/commands/attach.hpp
index 342b613..36c57ba 100644 (file)
--- a/libs/lxcpp/commands/attach.hpp
+++ b/libs/lxcpp/commands/attach.hpp
@@ -28,6 +28,8 @@
 #include "lxcpp/container-impl.hpp"
 #include "utils/channel.hpp"
 
+#include <sys/types.h>
+
 #include <string>
 
 namespace lxcpp {
@@ -44,6 +46,9 @@ public:
      *
      * @param container container to which it attaches
      * @param userCall user's function to run
+     * @param uid uid in the container
+     * @param gid gid in the container
+     * @param supplementaryGids supplementary groups in container
      * @param capsToKeep capabilities that will be kept
      * @param workDirInContainer work directory set for the new process
      * @param envToKeep environment variables that will be kept
@@ -51,6 +56,9 @@ public:
      */
     Attach(lxcpp::ContainerImpl& container,
            Container::AttachCall& userCall,
+           const uid_t uid,
+           const gid_t gid,
+           const std::vector<gid_t>& supplementaryGids,
            const int capsToKeep,
            const std::string& workDirInContainer,
            const std::vector<std::string>& envToKeep,
@@ -62,6 +70,9 @@ public:
 private:
     const lxcpp::ContainerImpl& mContainer;
     const Container::AttachCall& mUserCall;
+    const uid_t mUid;
+    const gid_t mGid;
+    const std::vector<gid_t>& mSupplementaryGids;
     const int mCapsToKeep;
     const std::string& mWorkDirInContainer;
     const std::vector<std::string>& mEnvToKeep;
@@ -69,6 +80,9 @@ private:
 
     // Methods for different stages of setting up the attachment
     static int child(const Container::AttachCall& call,
+                     const uid_t uid,
+                     const gid_t gid,
+                     const std::vector<gid_t>& supplementaryGids,
                      const int capsToKeep,
                      const std::vector<std::string>& envToKeep,
                      const std::vector<std::pair<std::string, std::string>>& envToSet);

diff --git a/libs/lxcpp/container-impl.cpp b/libs/lxcpp/container-impl.cpp
index 7189bc7..02e9f3a 100644 (file)
--- a/libs/lxcpp/container-impl.cpp
+++ b/libs/lxcpp/container-impl.cpp
@@ -109,6 +109,9 @@ void ContainerImpl::attach(Container::AttachCall& call,
 {
     Attach attach(*this,
                   call,
+                  /*uid in container*/ 0,
+                  /*gid in container*/ 0,
+                  /*supplementary gids in container*/ {},
                   /*capsToKeep*/ 0,
                   cwdInContainer,
                   /*envToKeep*/ {},

diff --git a/libs/lxcpp/credentials.cpp b/libs/lxcpp/credentials.cpp
new file mode 100644 (file)
index 0000000..692be25
--- /dev/null
+++ b/libs/lxcpp/credentials.cpp
@@ -0,0 +1,66 @@
+/*
+ *  Copyright (C) 2015 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License version 2.1 as published by the Free Software Foundation.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/**
+ * @file
+ * @author  Jan Olszak (j.olszak@samsung.com)
+ * @brief   Process credentials handling
+ */
+
+#include "lxcpp/credentials.hpp"
+#include "lxcpp/exception.hpp"
+
+#include "logger/logger.hpp"
+#include "utils/exception.hpp"
+
+#include <unistd.h>
+#include <grp.h>
+
+namespace lxcpp {
+
+void setgroups(const std::vector<gid_t>& gids)
+{
+    if(-1 == ::setgroups(gids.size(), gids.data())) {
+        const std::string msg = "setgroups() failed: " +
+                                utils::getSystemErrorMessage();
+        LOGE(msg);
+        throw CredentialSetupException(msg);
+    }
+}
+
+void setgid(const gid_t gid)
+{
+    if(-1 == ::setgid(gid)) {
+        const std::string msg = "setgid() failed: " +
+                                utils::getSystemErrorMessage();
+        LOGE(msg);
+        throw CredentialSetupException(msg);
+    }
+}
+
+void setuid(const uid_t uid)
+{
+    if(-1 == ::setuid(uid)) {
+        const std::string msg = "setuid() failed: " +
+                                utils::getSystemErrorMessage();
+        LOGE(msg);
+        throw CredentialSetupException(msg);
+    }
+}
+
+} // namespace lxcpp
+

diff --git a/libs/lxcpp/credentials.hpp b/libs/lxcpp/credentials.hpp
new file mode 100644 (file)
index 0000000..df00ce5
--- /dev/null
+++ b/libs/lxcpp/credentials.hpp
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2015 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License version 2.1 as published by the Free Software Foundation.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/**
+ * @file
+ * @author  Jan Olszak (j.olszak@samsung.com)
+ * @brief   Process credentials handling
+ */
+
+#ifndef LXCPP_CREDENTIALS_HPP
+#define LXCPP_CREDENTIALS_HPP
+
+#include <sys/types.h>
+
+#include <vector>
+
+namespace lxcpp {
+
+void setgroups(const std::vector<gid_t>& groups);
+
+void setgid(const gid_t gid);
+
+void setuid(const uid_t uid);
+
+
+
+} // namespace lxcpp
+
+#endif // LXCPP_CREDENTIALS_HPP
\ No newline at end of file

diff --git a/libs/lxcpp/exception.hpp b/libs/lxcpp/exception.hpp
index 8c11131..037da41 100644 (file)
--- a/libs/lxcpp/exception.hpp
+++ b/libs/lxcpp/exception.hpp
@@ -56,6 +56,11 @@ struct EnvironmentSetupException: public Exception {
         : Exception(message) {}
 };
 
+struct CredentialSetupException: public Exception {
+    CredentialSetupException(const std::string& message = "Error during handling environment variables")
+        : Exception(message) {}
+};
+
 struct CapabilitySetupException: public Exception {
     CapabilitySetupException(const std::string& message = "Error during a capability operation")
         : Exception(message) {}